diff --git a/backend/internal/app/bootstrap.go b/backend/internal/app/bootstrap.go
index 46b147d3..dde96634 100644
--- a/backend/internal/app/bootstrap.go
+++ b/backend/internal/app/bootstrap.go
@@ -905,7 +905,7 @@ func Bootstrap(env string) (*App, error) {
 		AssignmentPolicyV2:       v1.NewAssignmentPolicyV2Handler(assignmentPolicyV2Service),
 		// Enterprise: AuditLog, CustomRole, AgentCapacityPolicy, CsatMetrics handlers
 		Audit:         v1.NewAuditHandler(auditService),
-		CustomRole:    v1.NewCustomRoleHandler(customRoleService).WithAuditService(auditService),
+		CustomRole:    v1.NewCustomRoleHandler(customRoleService).WithAuditService(auditService).WithEventPublisher(eventPublisher),
 		AgentCapacity: v1.NewAgentCapacityHandler(agentCapacityPolicyService).WithAuditService(auditService),
 		CsatMetrics:   v1.NewCsatMetricsHandler(csatMetricsService),
 		Search:        v1.NewSearchHandler(searchService, db),
@@ -953,7 +953,7 @@ func Bootstrap(env string) (*App, error) {
 		Upload:              uploadHandler,
 		// Lane B: AssignableAgent handler (find agents available for assignment)
 		AssignableAgent: v1.NewAssignableAgentHandler(assignableAgentService),
-		Agent:           v1.NewAgentHandler(agentService).WithAuditService(auditService),
+		Agent:           v1.NewAgentHandler(agentService).WithAuditService(auditService).WithEventPublisher(eventPublisher),
 		AgentBulk:       v1.NewAgentBulkHandler(conversationService),
 		BulkAction:      v1.NewBulkActionHandler(conversationService, contactService).WithWorkerPool(workerPool),
 		// Lane C: CSAT template (singular per inbox) + Inbox limits
diff --git a/backend/internal/auth/coverage3_test.go b/backend/internal/auth/coverage3_test.go
index 4eefe7cc..e30b3ee0 100644
--- a/backend/internal/auth/coverage3_test.go
+++ b/backend/internal/auth/coverage3_test.go
@@ -579,7 +579,7 @@ func TestNewPolicyContext_Agent_Cov3(t *testing.T) {
 
 func TestNewPolicyContext_CustomRole_NilPerms_Cov3(t *testing.T) {
 	pc := NewPolicyContext(1, 1, "custom_role", 0, nil)
-	assert.Equal(t, AgentDefaultPermissions, pc.Permissions)
+	assert.Equal(t, PermissionMatrixMap{}, pc.Permissions)
 }
 
 // --- RefreshTokenStore tests ---
diff --git a/backend/internal/auth/coverage_test.go b/backend/internal/auth/coverage_test.go
index 24fd7216..2bda4b05 100644
--- a/backend/internal/auth/coverage_test.go
+++ b/backend/internal/auth/coverage_test.go
@@ -327,7 +327,7 @@ func TestNewPolicyContextCustomRole(t *testing.T) {
 func TestNewPolicyContextCustomRoleNilPerms(t *testing.T) {
 	pc := NewPolicyContext(1, 10, "custom_role", 5, nil)
 	assert.NotNil(t, pc)
-	assert.Equal(t, AgentDefaultPermissions, pc.Permissions)
+	assert.Equal(t, PermissionMatrixMap{}, pc.Permissions)
 }
 
 func TestPolicyContextCanAdministrator(t *testing.T) {
diff --git a/backend/internal/auth/policy.go b/backend/internal/auth/policy.go
index 300b8606..c8a4413a 100644
--- a/backend/internal/auth/policy.go
+++ b/backend/internal/auth/policy.go
@@ -155,9 +155,10 @@ func NewPolicyContext(userID, accountID uint, role string, customRoleID uint, pe
 	case "agent":
 		pc.Permissions = AgentDefaultPermissions
 	case "custom_role":
-		// Use the provided permissions matrix (from CustomRole)
+		// Use only the provided permissions matrix (from CustomRole). A missing
+		// matrix means no permissions; callers must not widen it to agent access.
 		if pc.Permissions == nil {
-			pc.Permissions = AgentDefaultPermissions // fallback
+			pc.Permissions = PermissionMatrixMap{}
 		}
 	}
 
diff --git a/backend/internal/handler/api/v1/agent_handler.go b/backend/internal/handler/api/v1/agent_handler.go
index 7f730f31..94641f3f 100644
--- a/backend/internal/handler/api/v1/agent_handler.go
+++ b/backend/internal/handler/api/v1/agent_handler.go
@@ -10,6 +10,7 @@ import (
 	"github.com/gochat/gochat/internal/model"
 	"github.com/gochat/gochat/internal/repository"
 	"github.com/gochat/gochat/internal/service"
+	"github.com/gochat/gochat/internal/ws"
 	applogger "github.com/gochat/gochat/pkg/logger"
 	"github.com/gochat/gochat/pkg/response"
 )
@@ -18,8 +19,9 @@ import (
 // Reference: Chatwoot app/controllers/api/v1/accounts/agents_controller.rb
 // An "agent" in Chatwoot is a User with an AccountUser membership in a specific account.
 type AgentHandler struct {
-	svc   *service.AgentService
-	audit *service.AuditService
+	svc    *service.AgentService
+	audit  *service.AuditService
+	events *ws.EventPublisher
 }
 
 func (h *AgentHandler) WithAuditService(audit *service.AuditService) *AgentHandler {
@@ -27,6 +29,11 @@ func (h *AgentHandler) WithAuditService(audit *service.AuditService) *AgentHandl
 	return h
 }
 
+func (h *AgentHandler) WithEventPublisher(events *ws.EventPublisher) *AgentHandler {
+	h.events = events
+	return h
+}
+
 // NewAgentHandler creates a new AgentHandler.
 func NewAgentHandler(svc *service.AgentService) *AgentHandler {
 	return &AgentHandler{svc: svc}
@@ -127,6 +134,7 @@ func (h *AgentHandler) Create(c *gin.Context) {
 
 	c.Header("Cache-Control", "no-store")
 	recordAuditMutation(c, h.audit, auditMutation{AccountID: accountID, AuditableType: "User", AuditableID: agent.ID, Action: "create", AuditedChanges: gin.H{"role": agent.Role, "active": agent.Active}})
+	publishRealtimeEvent(h.events, accountID, "page:reload", nil)
 	c.JSON(http.StatusOK, serializeAgentDetail(agent, accountID))
 }
 
@@ -171,6 +179,7 @@ func (h *AgentHandler) Update(c *gin.Context) {
 	}
 
 	recordAuditMutation(c, h.audit, auditMutation{AccountID: accountID, AuditableType: "User", AuditableID: uint(id), Action: "update", AuditedChanges: agentUpdateAuditChanges(req)})
+	publishRealtimeEvent(h.events, accountID, "page:reload", nil)
 	c.JSON(http.StatusOK, serializeAgentDetail(agent, accountID))
 }
 
@@ -198,6 +207,7 @@ func (h *AgentHandler) Delete(c *gin.Context) {
 	}
 
 	recordAuditMutation(c, h.audit, auditMutation{AccountID: accountID, AuditableType: "User", AuditableID: uint(id), Action: "destroy", AuditedChanges: gin.H{"account_id": accountID}})
+	publishRealtimeEvent(h.events, accountID, "page:reload", nil)
 	c.Status(http.StatusOK)
 }
 
@@ -267,6 +277,7 @@ func (h *AgentHandler) BulkCreate(c *gin.Context) {
 	}
 
 	c.Header("Cache-Control", "no-store")
+	publishRealtimeEvent(h.events, accountID, "page:reload", nil)
 	c.JSON(http.StatusOK, serializeAgentDetails(agents, accountID))
 }
 
diff --git a/backend/internal/handler/api/v1/agent_handler_test.go b/backend/internal/handler/api/v1/agent_handler_test.go
index a1ef088b..5ecf0603 100644
--- a/backend/internal/handler/api/v1/agent_handler_test.go
+++ b/backend/internal/handler/api/v1/agent_handler_test.go
@@ -169,6 +169,7 @@ func (s *AgentHandlerTestSuite) TestListIgnoresPerPageLikeChatwoot() {
 
 func (s *AgentHandlerTestSuite) TestCreateAgent() {
 	customRoleID := uint(7)
+	s.Require().NoError(s.db.Create(&model.CustomRole{ID: customRoleID, AccountID: s.account.ID, Name: "Custom", Permissions: "[]"}).Error)
 	req := service.CreateAgentRequest{
 		Email:        "agent1@test.com",
 		Name:         "Agent One",
diff --git a/backend/internal/handler/api/v1/custom_role_handler.go b/backend/internal/handler/api/v1/custom_role_handler.go
index 951ae700..9a7f70d0 100644
--- a/backend/internal/handler/api/v1/custom_role_handler.go
+++ b/backend/internal/handler/api/v1/custom_role_handler.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/gochat/gochat/internal/model"
 	"github.com/gochat/gochat/internal/service"
+	"github.com/gochat/gochat/internal/ws"
 	applogger "github.com/gochat/gochat/pkg/logger"
 	"github.com/gochat/gochat/pkg/response"
 )
@@ -16,6 +17,7 @@ import (
 type CustomRoleHandler struct {
 	svc      *service.CustomRoleService
 	auditSvc *service.AuditService
+	events   *ws.EventPublisher
 }
 
 // NewCustomRoleHandler creates a new CustomRole handler.
@@ -28,6 +30,11 @@ func (h *CustomRoleHandler) WithAuditService(auditSvc *service.AuditService) *Cu
 	return h
 }
 
+func (h *CustomRoleHandler) WithEventPublisher(events *ws.EventPublisher) *CustomRoleHandler {
+	h.events = events
+	return h
+}
+
 // List returns all custom roles for an account.
 // GET /api/v1/accounts/:account_id/custom_roles
 func (h *CustomRoleHandler) List(c *gin.Context) {
@@ -66,14 +73,18 @@ func (h *CustomRoleHandler) Create(c *gin.Context) {
 	}
 
 	var wrapper struct {
-		CustomRole service.CreateCustomRoleRequest `json:"custom_role"`
+		CustomRole *service.CreateCustomRoleRequest `json:"custom_role"`
 	}
 	if err := c.ShouldBindJSON(&wrapper); err != nil {
 		response.AbortWithStatusError(c, http.StatusBadRequest, response.ErrValidation, err.Error())
 		return
 	}
+	if wrapper.CustomRole == nil {
+		response.AbortWithStatusError(c, http.StatusBadRequest, response.ErrValidation, "custom_role envelope is required")
+		return
+	}
 
-	role, err := h.svc.Create(c.Request.Context(), accountID, wrapper.CustomRole)
+	role, err := h.svc.Create(c.Request.Context(), accountID, *wrapper.CustomRole)
 	if err != nil {
 		applogger.L().Errorf("Create custom role for account %d: %v", accountID, err)
 		handleServiceError(c, err)
@@ -86,6 +97,7 @@ func (h *CustomRoleHandler) Create(c *gin.Context) {
 		Action:         "create",
 		AuditedChanges: role,
 	})
+	publishRealtimeEvent(h.events, accountID, "page:reload", nil)
 
 	c.JSON(http.StatusOK, serializeCustomRole(role))
 }
@@ -140,14 +152,18 @@ func (h *CustomRoleHandler) Update(c *gin.Context) {
 	}
 
 	var wrapper struct {
-		CustomRole service.UpdateCustomRoleRequest `json:"custom_role"`
+		CustomRole *service.UpdateCustomRoleRequest `json:"custom_role"`
 	}
 	if err := c.ShouldBindJSON(&wrapper); err != nil {
 		response.AbortWithStatusError(c, http.StatusBadRequest, response.ErrValidation, err.Error())
 		return
 	}
+	if wrapper.CustomRole == nil {
+		response.AbortWithStatusError(c, http.StatusBadRequest, response.ErrValidation, "custom_role envelope is required")
+		return
+	}
 
-	role, svcErr := h.svc.Update(c.Request.Context(), id, accountID, wrapper.CustomRole)
+	role, svcErr := h.svc.Update(c.Request.Context(), id, accountID, *wrapper.CustomRole)
 	if svcErr != nil {
 		applogger.L().Errorf("Update custom role %d for account %d: %v", id, accountID, svcErr)
 		handleServiceError(c, svcErr)
@@ -160,6 +176,7 @@ func (h *CustomRoleHandler) Update(c *gin.Context) {
 		Action:         "update",
 		AuditedChanges: role,
 	})
+	publishRealtimeEvent(h.events, accountID, "page:reload", nil)
 
 	c.JSON(http.StatusOK, serializeCustomRole(role))
 }
@@ -195,6 +212,7 @@ func (h *CustomRoleHandler) Delete(c *gin.Context) {
 		Action:         "destroy",
 		AuditedChanges: gin.H{"id": id},
 	})
+	publishRealtimeEvent(h.events, accountID, "page:reload", nil)
 
 	c.Status(http.StatusOK)
 }
diff --git a/backend/internal/handler/api/v1/custom_role_handler_test.go b/backend/internal/handler/api/v1/custom_role_handler_test.go
index d4131f0d..1f60cf25 100644
--- a/backend/internal/handler/api/v1/custom_role_handler_test.go
+++ b/backend/internal/handler/api/v1/custom_role_handler_test.go
@@ -92,6 +92,18 @@ func (s *CustomRoleHandlerTestSuite) TestCreate_BadRequest_EmptyBody() {
 	assert.Equal(s.T(), http.StatusBadRequest, w.Code)
 }
 
+func (s *CustomRoleHandlerTestSuite) TestCreate_BadRequest_RequiresEnvelope() {
+	r := gin.New()
+	r.POST("/api/v1/accounts/:account_id/custom_roles", withCustomRoleAdminContext(s.account.ID, s.handler.Create))
+
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("POST", fmt.Sprintf("/api/v1/accounts/%d/custom_roles", s.account.ID), bytes.NewBufferString(`{"name":"raw-role","permissions":[]}`))
+	req.Header.Set("Content-Type", "application/json")
+	r.ServeHTTP(w, req)
+
+	assert.Equal(s.T(), http.StatusBadRequest, w.Code)
+}
+
 func (s *CustomRoleHandlerTestSuite) TestGet_BadRequest_InvalidID() {
 	r := gin.New()
 	r.GET("/api/v1/accounts/:account_id/custom_roles/:id", withCustomRoleAdminContext(s.account.ID, s.handler.Get))
@@ -115,6 +127,20 @@ func (s *CustomRoleHandlerTestSuite) TestUpdate_BadRequest_InvalidID() {
 	assert.Equal(s.T(), http.StatusBadRequest, w.Code)
 }
 
+func (s *CustomRoleHandlerTestSuite) TestUpdate_BadRequest_RequiresEnvelope() {
+	role := &model.CustomRole{AccountID: s.account.ID, Name: "raw-update", Permissions: `[]`}
+	s.Require().NoError(s.db.Create(role).Error)
+
+	r := gin.New()
+	r.PATCH("/api/v1/accounts/:account_id/custom_roles/:id", withCustomRoleAdminContext(s.account.ID, s.handler.Update))
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("PATCH", fmt.Sprintf("/api/v1/accounts/%d/custom_roles/%d", s.account.ID, role.ID), bytes.NewBufferString(`{"name":"raw-update-edited","permissions":[]}`))
+	req.Header.Set("Content-Type", "application/json")
+	r.ServeHTTP(w, req)
+
+	assert.Equal(s.T(), http.StatusBadRequest, w.Code)
+}
+
 func (s *CustomRoleHandlerTestSuite) TestDelete_BadRequest_InvalidID() {
 	r := gin.New()
 	r.DELETE("/api/v1/accounts/:account_id/custom_roles/:id", withCustomRoleAdminContext(s.account.ID, s.handler.Delete))
diff --git a/backend/internal/middleware/account_scope.go b/backend/internal/middleware/account_scope.go
index 09912e6c..a64197bd 100644
--- a/backend/internal/middleware/account_scope.go
+++ b/backend/internal/middleware/account_scope.go
@@ -95,10 +95,15 @@ func AccountScope() gin.HandlerFunc {
 				}
 			}
 		}
+		if roleStr == "administrator" && customRoleID > 0 {
+			response.AbortWithStatusError(c, http.StatusForbidden, response.ErrForbidden,
+				"invalid administrator custom role assignment")
+			return
+		}
 
 		// Step 6: Build PolicyContext from JWT claims data
 		// For custom_role, permissions will be nil (loaded by service layer)
-		var permissions auth.PermissionMatrixMap
+		permissions := auth.PermissionMatrixMap{}
 		policyCtx := auth.NewPolicyContext(
 			userID.(uint),
 			accountID,
@@ -168,17 +173,23 @@ func AccountScopeWithService(lookup RBACLookup) gin.HandlerFunc {
 				"User does not belong to this account")
 			return
 		}
+		if role == "administrator" && customRoleID > 0 {
+			response.AbortWithStatusError(c, http.StatusForbidden, response.ErrForbidden,
+				"invalid administrator custom role assignment")
+			return
+		}
 
-		// Build permissions matrix based on role
+		// Build permissions matrix based on role. A custom-role lookup failure must
+		// fail closed; Agent defaults would grant permissions to a broken assignment.
 		permissions := auth.PermissionMatrixMap{}
-		if customRoleID > 0 && role != "administrator" {
-			pm, err := lookup.GetCustomRolePermissions(customRoleID)
-			if err != nil {
-				// Fallback to agent defaults if custom role not found
-				permissions = auth.AgentDefaultPermissions
-			} else {
-				permissions = pm
+		if customRoleID > 0 {
+			pm, err := lookup.GetCustomRolePermissionsForAccount(customRoleID, accountID)
+			if err != nil || pm == nil {
+				response.AbortWithStatusError(c, http.StatusForbidden, response.ErrForbidden,
+					"custom role permissions unavailable")
+				return
 			}
+			permissions = pm
 		}
 
 		effectiveRole := role
@@ -285,5 +296,5 @@ func isSuperAdminContext(c *gin.Context) bool {
 // for use with AccountScopeWithService middleware.
 type RBACLookup interface {
 	GetAccountUserRole(userID, accountID uint) (role string, customRoleID uint, err error)
-	GetCustomRolePermissions(customRoleID uint) (auth.PermissionMatrixMap, error)
+	GetCustomRolePermissionsForAccount(customRoleID, accountID uint) (auth.PermissionMatrixMap, error)
 }
diff --git a/backend/internal/middleware/account_scope_test.go b/backend/internal/middleware/account_scope_test.go
index 67664ef6..e539ff80 100644
--- a/backend/internal/middleware/account_scope_test.go
+++ b/backend/internal/middleware/account_scope_test.go
@@ -23,7 +23,7 @@ func (l accountScopeLookup) GetAccountUserRole(_ uint, accountID uint) (string,
 	return "administrator", 0, nil
 }
 
-func (accountScopeLookup) GetCustomRolePermissions(uint) (auth.PermissionMatrixMap, error) {
+func (accountScopeLookup) GetCustomRolePermissionsForAccount(uint, uint) (auth.PermissionMatrixMap, error) {
 	return nil, nil
 }
 
@@ -185,6 +185,39 @@ func TestAccountScope_UsesAuthMiddlewareRoleForAdministratorRoute(t *testing.T)
 	assert.Equal(t, http.StatusOK, w.Code, w.Body.String())
 }
 
+func TestAccountScope_RejectsAdministratorCustomRoleClaims(t *testing.T) {
+	r := gin.New()
+	r.Use(func(c *gin.Context) {
+		c.Set("user_id", uint(1))
+		c.Set("role", "administrator")
+		c.Set("claims", &auth.Claims{Role: "administrator", CustomRoleID: 9})
+		c.Next()
+	})
+	r.Use(AccountScope())
+	r.GET("/api/v1/accounts/:account_id", func(c *gin.Context) { c.Status(http.StatusOK) })
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/api/v1/accounts/1", nil))
+	assert.Equal(t, http.StatusForbidden, w.Code)
+}
+
+func TestAccountScope_RejectsCustomRoleClaimsWithoutLoadedPermissions(t *testing.T) {
+	r := gin.New()
+	r.Use(func(c *gin.Context) {
+		c.Set("user_id", uint(1))
+		c.Set("role", "agent")
+		c.Set("claims", &auth.Claims{Role: "agent", CustomRoleID: 9})
+		c.Next()
+	})
+	r.Use(AccountScope())
+	r.Use(PolicyMiddleware("conversation", "read"))
+	r.GET("/api/v1/accounts/:account_id", func(c *gin.Context) { c.Status(http.StatusOK) })
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/api/v1/accounts/1", nil))
+	assert.Equal(t, http.StatusForbidden, w.Code)
+}
+
 func TestAccountScopeWithService_AllowsVerifiedAccountSwitch(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 	r := gin.New()
diff --git a/backend/internal/middleware/cors_logger.go b/backend/internal/middleware/cors_logger.go
index 8c975a54..5d2b663e 100644
--- a/backend/internal/middleware/cors_logger.go
+++ b/backend/internal/middleware/cors_logger.go
@@ -7,14 +7,23 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
-// CORSMiddleware adds permissive CORS headers for development.
+var legacyCORSAllowedOrigins = []string{
+	"http://localhost:3000",
+	"http://localhost:5000",
+	"http://127.0.0.1:3000",
+	"http://127.0.0.1:5000",
+}
+
+// CORSMiddleware adds CORS headers for the local development origins.
 func CORSMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		c.Header("Access-Control-Allow-Origin", "*")
+		if origin := c.Request.Header.Get("Origin"); origin != "" && isOriginAllowed(origin, legacyCORSAllowedOrigins) {
+			c.Header("Access-Control-Allow-Origin", origin)
+			c.Header("Vary", "Origin")
+		}
 		c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
 		c.Header("Access-Control-Allow-Headers", "Origin, Content-Type, Accept, Authorization")
 		c.Header("Access-Control-Max-Age", "86400")
-		c.Header("Access-Control-Allow-Credentials", "true")
 
 		if c.Request.Method == "OPTIONS" {
 			c.AbortWithStatus(204)
@@ -39,4 +48,4 @@ func RequestLoggerMiddleware() gin.HandlerFunc {
 
 		fmt.Fprintf(gin.DefaultWriter, "%s %s %d %v\n", method, path, status, latency)
 	}
-}
\ No newline at end of file
+}
diff --git a/backend/internal/middleware/cors_logger_test.go b/backend/internal/middleware/cors_logger_test.go
index 6b242bde..d879bdde 100644
--- a/backend/internal/middleware/cors_logger_test.go
+++ b/backend/internal/middleware/cors_logger_test.go
@@ -16,14 +16,15 @@ func TestCORSMiddleware_Headers(t *testing.T) {
 
 	w := httptest.NewRecorder()
 	req := httptest.NewRequest("GET", "/test", nil)
+	req.Header.Set("Origin", "http://localhost:5000")
 	r.ServeHTTP(w, req)
 
 	assert.Equal(t, 200, w.Code)
-	assert.Equal(t, "*", w.Header().Get("Access-Control-Allow-Origin"))
+	assert.Equal(t, "http://localhost:5000", w.Header().Get("Access-Control-Allow-Origin"))
 	assert.Contains(t, w.Header().Get("Access-Control-Allow-Methods"), "GET")
 	assert.Contains(t, w.Header().Get("Access-Control-Allow-Headers"), "Authorization")
 	assert.Equal(t, "86400", w.Header().Get("Access-Control-Max-Age"))
-	assert.Equal(t, "true", w.Header().Get("Access-Control-Allow-Credentials"))
+	assert.Empty(t, w.Header().Get("Access-Control-Allow-Credentials"))
 }
 
 func TestCORSMiddleware_Options(t *testing.T) {
diff --git a/backend/internal/middleware/coverage6_test.go b/backend/internal/middleware/coverage6_test.go
index d13cc5dd..2e412080 100644
--- a/backend/internal/middleware/coverage6_test.go
+++ b/backend/internal/middleware/coverage6_test.go
@@ -99,7 +99,7 @@ func TestCORSMiddleware_Options_Cov6(t *testing.T) {
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
 	c.Request = httptest.NewRequest("OPTIONS", "/api/test", nil)
-	c.Request.Header.Set("Origin", "https://example.com")
+	c.Request.Header.Set("Origin", "http://localhost:3000")
 	handler(c)
 }
 
@@ -109,7 +109,7 @@ func TestCORSMiddleware_Get_Cov6(t *testing.T) {
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
 	c.Request = httptest.NewRequest("GET", "/api/test", nil)
-	c.Request.Header.Set("Origin", "https://example.com")
+	c.Request.Header.Set("Origin", "http://localhost:3000")
 	handler(c)
 }
 
diff --git a/backend/internal/middleware/coverage7_test.go b/backend/internal/middleware/coverage7_test.go
index 9cf0221e..3cb112fc 100644
--- a/backend/internal/middleware/coverage7_test.go
+++ b/backend/internal/middleware/coverage7_test.go
@@ -1429,7 +1429,7 @@ func TestCORS_DevMode_Cov7(t *testing.T) {
 	c.Request = httptest.NewRequest("GET", "/", nil)
 	c.Request.Header.Set("Origin", "http://localhost:3000")
 	CORS(CORSConfig{DevMode: true})(c)
-	assert.Equal(t, "*", w.Header().Get("Access-Control-Allow-Origin"))
+	assert.NotEmpty(t, w.Header().Get("Access-Control-Allow-Origin"))
 }
 
 func TestCORS_Options_Cov7(t *testing.T) {
@@ -1460,22 +1460,11 @@ func TestCORS_NotAllowedOrigin_Cov7(t *testing.T) {
 }
 
 func TestCORS_WildcardSubdomain_Cov7(t *testing.T) {
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest("GET", "/", nil)
-	c.Request.Header.Set("Origin", "https://foo.example.com")
-	CORS(CORSConfig{AllowedOrigins: []string{"*.example.com"}, AllowCredentials: true})(c)
-	assert.Equal(t, "https://foo.example.com", w.Header().Get("Access-Control-Allow-Origin"))
-	assert.Equal(t, "true", w.Header().Get("Access-Control-Allow-Credentials"))
+	assert.True(t, isOriginAllowed("https://foo.example.com", []string{"*.example.com"}))
 }
 
 func TestCORS_WildcardNoSubdomain_Cov7(t *testing.T) {
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest("GET", "/", nil)
-	c.Request.Header.Set("Origin", "https://example.com")
-	CORS(CORSConfig{AllowedOrigins: []string{"*.example.com"}})(c)
-	assert.Empty(t, w.Header().Get("Access-Control-Allow-Origin"))
+	assert.False(t, isOriginAllowed("https://example.com", []string{"*.example.com"}))
 }
 
 func TestCORS_CustomMethods_Cov7(t *testing.T) {
@@ -1790,8 +1779,9 @@ func TestCORSMiddleware_Legacy_Cov7(t *testing.T) {
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
 	c.Request = httptest.NewRequest("GET", "/", nil)
+	c.Request.Header.Set("Origin", "http://localhost:5000")
 	CORSMiddleware()(c)
-	assert.Equal(t, "*", w.Header().Get("Access-Control-Allow-Origin"))
+	assert.Equal(t, "http://localhost:5000", w.Header().Get("Access-Control-Allow-Origin"))
 }
 
 func TestCORSMiddleware_LegacyOptions_Cov7(t *testing.T) {
@@ -2102,7 +2092,7 @@ func (m *mockRBACLookup_Cov7) GetAccountUserRole(userID, accountID uint) (string
 	return m.role, m.customRole, m.roleErr
 }
 
-func (m *mockRBACLookup_Cov7) GetCustomRolePermissions(customRoleID uint) (auth.PermissionMatrixMap, error) {
+func (m *mockRBACLookup_Cov7) GetCustomRolePermissionsForAccount(customRoleID, accountID uint) (auth.PermissionMatrixMap, error) {
 	return m.perms, m.permsErr
 }
 
@@ -2185,7 +2175,8 @@ func TestAccountScopeWithService_CustomRolePermsError_Cov7(t *testing.T) {
 	c.Request.Header.Set("X-Account-ID", "1")
 	c.Set("user_id", uint(1))
 	AccountScopeWithService(lookup)(c)
-	assert.False(t, c.IsAborted())
+	assert.True(t, c.IsAborted())
+	assert.Equal(t, http.StatusForbidden, w.Code)
 }
 
 func TestAccountScopeWithService_RouteAccountID_Cov7(t *testing.T) {
diff --git a/backend/internal/model/custom_role.go b/backend/internal/model/custom_role.go
index afb61465..72ab363a 100644
--- a/backend/internal/model/custom_role.go
+++ b/backend/internal/model/custom_role.go
@@ -114,10 +114,9 @@ func (cr *CustomRole) SetPermissionKeys(keys []PermissionDimension) error {
 	return nil
 }
 
-// GetPermissionMap deserializes the JSONB permissions field into a map of
-// PermissionDimension → PermissionLevel. This is the raw deserialization;
-// the auth.PolicyContext layer converts this into auth.PermissionMatrix for
-// policy evaluation.
+// GetPermissionMap deserializes the JSONB permissions field into a binary map
+// of PermissionDimension → PermissionLevel. Legacy non-none levels normalize
+// to full; unsupported dimensions normalize to none.
 func (cr *CustomRole) GetPermissionMap() (map[PermissionDimension]PermissionLevel, error) {
 	var keys []PermissionDimension
 	if err := json.Unmarshal([]byte(cr.Permissions), &keys); err == nil {
@@ -132,7 +131,7 @@ func (cr *CustomRole) GetPermissionMap() (map[PermissionDimension]PermissionLeve
 		return pm, nil
 	}
 
-	var m map[PermissionDimension]PermissionLevel
+	m := make(map[PermissionDimension]PermissionLevel)
 	if cr.Permissions == "" || cr.Permissions == "{}" {
 		return map[PermissionDimension]PermissionLevel{}, nil
 	}
@@ -143,6 +142,13 @@ func (cr *CustomRole) GetPermissionMap() (map[PermissionDimension]PermissionLeve
 		if level != PermissionLevelFull && level != PermissionLevelRead && level != PermissionLevelNone {
 			return nil, fmt.Errorf("invalid permission level '%s' for dimension '%s'", level, dim)
 		}
+		if !IsValidCustomRolePermission(dim) {
+			m[dim] = PermissionLevelNone
+			continue
+		}
+		if level != PermissionLevelNone {
+			m[dim] = PermissionLevelFull
+		}
 	}
 	return m, nil
 }
diff --git a/backend/internal/model/methods_test.go b/backend/internal/model/methods_test.go
index 55c30687..4ce35263 100644
--- a/backend/internal/model/methods_test.go
+++ b/backend/internal/model/methods_test.go
@@ -124,6 +124,18 @@ func TestCustomRoleGetPermissionMap(t *testing.T) {
 	assert.Empty(t, pm[model.DimensionAutomationManage])
 }
 
+func TestCustomRoleLegacyPermissionMapUsesBinaryLevels(t *testing.T) {
+	cr := &model.CustomRole{
+		Permissions: `{"conversation_manage":"read","conversation_delete":"full","contact_manage":"none"}`,
+	}
+
+	pm, err := cr.GetPermissionMap()
+	assert.NoError(t, err)
+	assert.Equal(t, model.PermissionLevelFull, pm[model.DimensionConversationManage])
+	assert.Equal(t, model.PermissionLevelNone, pm[model.DimensionConversationDelete])
+	assert.Equal(t, model.PermissionLevelNone, pm[model.DimensionContactManage])
+}
+
 func TestCustomRoleGetPermissionMapEmpty(t *testing.T) {
 	cr := &model.CustomRole{Permissions: "{}"}
 	pm, err := cr.GetPermissionMap()
diff --git a/backend/internal/repository/account_user_agent_test.go b/backend/internal/repository/account_user_agent_test.go
index f87a8dcb..9ecc9fe4 100644
--- a/backend/internal/repository/account_user_agent_test.go
+++ b/backend/internal/repository/account_user_agent_test.go
@@ -418,6 +418,7 @@ func TestAgentRepo_UpdateAgent_CustomRole(t *testing.T) {
 
 	account := &model.Account{Name: "A"}
 	require.NoError(t, db.Create(account).Error)
+	require.NoError(t, db.Create(&model.CustomRole{ID: 5, AccountID: account.ID, Name: "Custom", Permissions: "[]"}).Error)
 	user := &model.User{Name: "John", Email: "john@e.com", Password: "p", AccountID: account.ID}
 	require.NoError(t, db.Create(user).Error)
 	require.NoError(t, db.Create(&model.AccountUser{AccountID: account.ID, UserID: user.ID, Role: "agent"}).Error)
diff --git a/backend/internal/repository/agent_repo.go b/backend/internal/repository/agent_repo.go
index 4f6575d9..94ffb130 100644
--- a/backend/internal/repository/agent_repo.go
+++ b/backend/internal/repository/agent_repo.go
@@ -3,9 +3,11 @@ package repository
 import (
 	"context"
 	"errors"
+	"fmt"
 	"time"
 
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 
 	"github.com/gochat/gochat/internal/model"
 )
@@ -26,6 +28,34 @@ func NewAgentRepo(db *gorm.DB) *AgentRepo {
 	return &AgentRepo{db: db}
 }
 
+func normalizeAgentRole(role string, customRoleID uint) (string, error) {
+	if customRoleID == 0 {
+		return role, nil
+	}
+	if role == "administrator" {
+		return "", fmt.Errorf("invalid role assignment: administrator cannot have a custom role")
+	}
+	return "agent", nil
+}
+
+func validateCustomRoleAssignment(tx *gorm.DB, accountID, customRoleID uint) error {
+	if customRoleID == 0 {
+		return nil
+	}
+
+	var role model.CustomRole
+	err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).
+		Where("id = ? AND account_id = ? AND deleted_at IS NULL", customRoleID, accountID).
+		First(&role).Error
+	if err == nil {
+		return nil
+	}
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return fmt.Errorf("custom role %d not found for account %d", customRoleID, accountID)
+	}
+	return fmt.Errorf("validate custom role %d: %w", customRoleID, err)
+}
+
 // AgentDetail represents an agent as returned by the API — User with their
 // AccountUser role/availability for the specific account.
 // Reference: Chatwoot renders User objects with included account_users.
@@ -146,72 +176,84 @@ func (r *AgentRepo) FindAgentByID(ctx context.Context, userID, accountID uint) (
 // Reference: Chatwoot agents_controller.rb#create → AgentBuilder.new.perform
 // If the user does not exist, creates the user first, then creates the AccountUser.
 func (r *AgentRepo) CreateAgent(ctx context.Context, accountID uint, inviterID uint, name, email, role, availability string, autoOffline bool, customRoleID uint, passwordDigest string, confirmedAt time.Time) (*AgentDetail, error) {
-	// Find or create the user
-	var user model.User
-	isNewUser := false
-	err := r.db.WithContext(ctx).Where("email = ?", email).First(&user).Error
-	if err == gorm.ErrRecordNotFound {
-		// Create new user
-		if name == "" {
-			name = email
-			if atIdx := indexOfAt(email); atIdx > 0 {
-				name = email[:atIdx]
+	role, err := normalizeAgentRole(role, customRoleID)
+	if err != nil {
+		return nil, err
+	}
+
+	var detail AgentDetail
+	err = r.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := validateCustomRoleAssignment(tx, accountID, customRoleID); err != nil {
+			return err
+		}
+
+		// Find or create the user.
+		var user model.User
+		isNewUser := false
+		err := tx.Where("email = ?", email).First(&user).Error
+		if err == gorm.ErrRecordNotFound {
+			if name == "" {
+				name = email
+				if atIdx := indexOfAt(email); atIdx > 0 {
+					name = email[:atIdx]
+				}
 			}
+			user = model.User{
+				AccountID:      accountID,
+				Name:           name,
+				Email:          email,
+				Password:       passwordDigest,
+				PasswordDigest: passwordDigest,
+				Provider:       "email",
+				Active:         true,
+				ConfirmedAt:    &confirmedAt,
+			}
+			if err := tx.Create(&user).Error; err != nil {
+				return err
+			}
+			isNewUser = true
+		} else if err != nil {
+			return err
 		}
-		user = model.User{
-			AccountID:      accountID,
-			Name:           name,
-			Email:          email,
-			Password:       passwordDigest,
-			PasswordDigest: passwordDigest,
-			Provider:       "email",
-			Active:         true,
-			ConfirmedAt:    &confirmedAt,
+
+		// Check if AccountUser already exists.
+		var existingAU model.AccountUser
+		err = tx.Where("account_id = ? AND user_id = ?", accountID, user.ID).First(&existingAU).Error
+		if err == nil {
+			return ErrAlreadyMember
+		} else if err != gorm.ErrRecordNotFound {
+			return err
 		}
-		if err := r.db.WithContext(ctx).Create(&user).Error; err != nil {
-			return nil, err
+
+		au := model.AccountUser{
+			UserID:       user.ID,
+			AccountID:    accountID,
+			Role:         role,
+			CustomRoleID: customRoleID,
+			Availability: availability,
+			AutoOffline:  autoOffline,
+			InvitedBy:    inviterID,
 		}
-		isNewUser = true
-	} else if err != nil {
+		if err := tx.Select("UserID", "AccountID", "Role", "CustomRoleID", "Availability", "AutoOffline", "InvitedBy").Create(&au).Error; err != nil {
+			return err
+		}
+
+		detail = AgentDetail{
+			User:          user,
+			Role:          au.Role,
+			Availability:  au.Availability,
+			AutoOffline:   au.AutoOffline,
+			InvitedBy:     au.InvitedBy,
+			AccountUserID: au.ID,
+			CustomRoleID:  au.CustomRoleID,
+			IsNewUser:     isNewUser,
+		}
+		return nil
+	})
+	if err != nil {
 		return nil, err
 	}
-
-	// Check if AccountUser already exists
-	var existingAU model.AccountUser
-	err = r.db.WithContext(ctx).
-		Where("account_id = ? AND user_id = ?", accountID, user.ID).
-		First(&existingAU).Error
-	if err == nil {
-		// Already a member — return conflict error
-		return nil, ErrAlreadyMember
-	} else if err != gorm.ErrRecordNotFound {
-		return nil, err
-	}
-
-	// Create AccountUser
-	au := model.AccountUser{
-		UserID:       user.ID,
-		AccountID:    accountID,
-		Role:         role,
-		CustomRoleID: customRoleID,
-		Availability: availability,
-		AutoOffline:  autoOffline,
-		InvitedBy:    inviterID,
-	}
-	if err := r.db.WithContext(ctx).Select("UserID", "AccountID", "Role", "CustomRoleID", "Availability", "AutoOffline", "InvitedBy").Create(&au).Error; err != nil {
-		return nil, err
-	}
-
-	return &AgentDetail{
-		User:          user,
-		Role:          au.Role,
-		Availability:  au.Availability,
-		AutoOffline:   au.AutoOffline,
-		InvitedBy:     au.InvitedBy,
-		AccountUserID: au.ID,
-		CustomRoleID:  au.CustomRoleID,
-		IsNewUser:     isNewUser,
-	}, nil
+	return &detail, nil
 }
 
 // UpdateAgent updates both the User (name) and AccountUser (role, availability, auto_offline).
@@ -222,6 +264,32 @@ func (r *AgentRepo) UpdateAgent(ctx context.Context, userID, accountID uint, nam
 
 func (r *AgentRepo) UpdateAgentWithActive(ctx context.Context, userID, accountID uint, name, role, availability string, autoOffline bool, autoOfflineSet bool, customRoleID *uint, customRoleIDSet bool, active *bool, beforeCommit func() error) (*AgentDetail, error) {
 	if err := r.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		var currentAU model.AccountUser
+		if err := tx.Where("account_id = ? AND user_id = ?", accountID, userID).First(&currentAU).Error; err != nil {
+			return err
+		}
+
+		assignedCustomRoleID := currentAU.CustomRoleID
+		if customRoleIDSet {
+			assignedCustomRoleID = 0
+			if customRoleID != nil {
+				assignedCustomRoleID = *customRoleID
+			}
+		}
+		if role == "administrator" && assignedCustomRoleID > 0 {
+			return fmt.Errorf("invalid role assignment: administrator cannot have a custom role")
+		}
+		if assignedCustomRoleID > 0 {
+			normalizedRole, err := normalizeAgentRole(role, assignedCustomRoleID)
+			if err != nil {
+				return err
+			}
+			role = normalizedRole
+			if err := validateCustomRoleAssignment(tx, accountID, assignedCustomRoleID); err != nil {
+				return err
+			}
+		}
+
 		userUpdates := map[string]interface{}{}
 		if name != "" {
 			userUpdates["name"] = name
diff --git a/backend/internal/repository/custom_role_repo.go b/backend/internal/repository/custom_role_repo.go
index ee19ff4f..5b5979d6 100644
--- a/backend/internal/repository/custom_role_repo.go
+++ b/backend/internal/repository/custom_role_repo.go
@@ -2,8 +2,10 @@ package repository
 
 import (
 	"context"
+	"errors"
 
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 
 	"github.com/gochat/gochat/internal/model"
 )
@@ -74,12 +76,24 @@ func (r *CustomRoleRepo) Update(ctx context.Context, role *model.CustomRole) err
 // Delete soft-deletes a custom role (GORM DeletedAt field).
 func (r *CustomRoleRepo) Delete(ctx context.Context, id, accountID uint) error {
 	return r.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		var role model.CustomRole
+		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Unscoped().First(&role, id).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return nil
+			}
+			return err
+		}
+		if role.AccountID != accountID {
+			return gorm.ErrRecordNotFound
+		}
+		if role.DeletedAt.Valid {
+			return nil
+		}
 		if err := tx.Model(&model.AccountUser{}).
 			Where("account_id = ? AND custom_role_id = ?", accountID, id).
 			Updates(map[string]interface{}{"role": "agent", "custom_role_id": 0}).Error; err != nil {
 			return err
 		}
-		return tx.Where("id = ? AND account_id = ?", id, accountID).
-			Delete(&model.CustomRole{}).Error
+		return tx.Delete(&role).Error
 	})
 }
diff --git a/backend/internal/repository/custom_role_repo_test.go b/backend/internal/repository/custom_role_repo_test.go
index c9b385d1..95b36926 100644
--- a/backend/internal/repository/custom_role_repo_test.go
+++ b/backend/internal/repository/custom_role_repo_test.go
@@ -188,6 +188,20 @@ func TestCustomRoleRepo_Delete(t *testing.T) {
 	assert.NotNil(t, found.DeletedAt)
 }
 
+func TestCustomRoleRepo_Delete_RejectsOtherAccount(t *testing.T) {
+	db := setupTestDB(t, &model.CustomRole{})
+	repo := NewCustomRoleRepo(db)
+
+	account := createCustomRoleTestAccount(t, db)
+	otherAccount := createCustomRoleTestAccount(t, db)
+	role := createTestCustomRole(t, db, account.ID, "Supervisor")
+
+	err := repo.Delete(context.Background(), role.ID, otherAccount.ID)
+	assert.ErrorIs(t, err, gorm.ErrRecordNotFound)
+	_, err = repo.FindByIDAndAccount(context.Background(), role.ID, account.ID)
+	assert.NoError(t, err)
+}
+
 func TestCustomRoleRepo_Delete_NotFound(t *testing.T) {
 	db := setupTestDB(t, &model.CustomRole{})
 	repo := NewCustomRoleRepo(db)
diff --git a/backend/internal/service/agent_service.go b/backend/internal/service/agent_service.go
index 4edb2d15..038d3d05 100644
--- a/backend/internal/service/agent_service.go
+++ b/backend/internal/service/agent_service.go
@@ -30,7 +30,10 @@ type AgentService struct {
 	disconnectUser func(uint)
 }
 
-var ErrAgentNameBlank = errors.New("agent name cannot be blank")
+var (
+	ErrAgentNameBlank           = errors.New("agent name cannot be blank")
+	ErrInvalidAgentRoleAssignee = errors.New("invalid agent role assignment")
+)
 
 // NewAgentService creates a new Agent service.
 func NewAgentService(agentRepo *repository.AgentRepo, db *gorm.DB) *AgentService {
@@ -136,6 +139,11 @@ func (s *AgentService) Create(ctx context.Context, accountID uint, inviterID uin
 	if req.CustomRoleID != nil {
 		customRoleID = *req.CustomRoleID
 	}
+	normalizedRole, err := normalizeAgentRoleAssignment(role, req.CustomRoleID)
+	if err != nil {
+		return nil, err
+	}
+	role = normalizedRole
 	temporaryPassword, err := generateTemporaryPassword()
 	if err != nil {
 		return nil, fmt.Errorf("generate temporary password: %w", err)
@@ -169,11 +177,16 @@ func (s *AgentService) Update(ctx context.Context, userID, accountID uint, req U
 		return nil, ErrAgentNameBlank
 	}
 
+	role, err := normalizeAgentRoleAssignment(req.Role, req.CustomRoleID)
+	if err != nil {
+		return nil, err
+	}
+
 	var revokeRefreshTokens func() error
 	if req.Active != nil && !*req.Active && s.refreshStore != nil {
 		revokeRefreshTokens = func() error { return s.refreshStore.RevokeUser(ctx, userID) }
 	}
-	agent, err := s.agentRepo.UpdateAgentWithActive(ctx, userID, accountID, req.Name, req.Role, req.Availability, req.AutoOffline, req.AutoOfflineSet(), req.CustomRoleID, req.CustomRoleIDSet(), req.Active, revokeRefreshTokens)
+	agent, err := s.agentRepo.UpdateAgentWithActive(ctx, userID, accountID, req.Name, role, req.Availability, req.AutoOffline, req.AutoOfflineSet(), req.CustomRoleID, req.CustomRoleIDSet(), req.Active, revokeRefreshTokens)
 	if err != nil || req.Active == nil || *req.Active {
 		return agent, err
 	}
@@ -188,6 +201,16 @@ func (s *AgentService) Delete(ctx context.Context, userID, accountID uint) error
 	return s.agentRepo.DeleteAgent(ctx, userID, accountID)
 }
 
+func normalizeAgentRoleAssignment(role string, customRoleID *uint) (string, error) {
+	if customRoleID == nil || *customRoleID == 0 {
+		return role, nil
+	}
+	if role == "administrator" {
+		return "", fmt.Errorf("%w: administrator cannot have a custom role", ErrInvalidAgentRoleAssignee)
+	}
+	return "agent", nil
+}
+
 // ResetPassword assigns a new one-time-visible random password to an email agent.
 // The plaintext password is returned to the administrator and is never persisted.
 func (s *AgentService) ResetPassword(ctx context.Context, userID, accountID uint) (string, error) {
diff --git a/backend/internal/service/rbac_custom_role_test.go b/backend/internal/service/rbac_custom_role_test.go
index 2a08b9a5..c4c99cc6 100644
--- a/backend/internal/service/rbac_custom_role_test.go
+++ b/backend/internal/service/rbac_custom_role_test.go
@@ -65,6 +65,42 @@ func TestRBACService_UpdateAccountUserRoleStoresAgentForCustomRole(t *testing.T)
 	assert.Equal(t, role.ID, au.CustomRoleID)
 }
 
+func TestRBACService_CustomRoleAssignmentIsAccountScoped(t *testing.T) {
+	svc, db := setupRBACCustomRoleTest(t)
+	account := &model.Account{Name: "Account One", Active: true}
+	otherAccount := &model.Account{Name: "Account Two", Active: true}
+	require.NoError(t, db.Create(account).Error)
+	require.NoError(t, db.Create(otherAccount).Error)
+	user := &model.User{AccountID: account.ID, Name: "Scoped Agent", Email: "scoped-agent@example.com", Password: "pw", Active: true}
+	require.NoError(t, db.Create(user).Error)
+	role := &model.CustomRole{AccountID: otherAccount.ID, Name: "Other Account Role"}
+	require.NoError(t, role.SetPermissionKeys([]model.PermissionDimension{model.DimensionReportManage}))
+	require.NoError(t, db.Create(role).Error)
+
+	_, err := svc.AddAccountUser(user.ID, account.ID, "agent", role.ID, 0)
+	require.Error(t, err)
+
+	require.NoError(t, db.Create(&model.AccountUser{AccountID: account.ID, UserID: user.ID, Role: "agent", CustomRoleID: role.ID}).Error)
+	_, err = svc.BuildPolicyContext(user.ID, account.ID)
+	require.Error(t, err)
+}
+
+func TestRBACService_AdministratorCannotUseCustomRole(t *testing.T) {
+	svc, db := setupRBACCustomRoleTest(t)
+	account := &model.Account{Name: "Admin Account", Active: true}
+	require.NoError(t, db.Create(account).Error)
+	user := &model.User{AccountID: account.ID, Name: "Admin", Email: "admin-custom@example.com", Password: "pw", Active: true}
+	require.NoError(t, db.Create(user).Error)
+	role := &model.CustomRole{AccountID: account.ID, Name: "Restricted"}
+	require.NoError(t, db.Create(role).Error)
+
+	_, err := svc.AddAccountUser(user.ID, account.ID, "administrator", role.ID, 0)
+	require.Error(t, err)
+	require.NoError(t, db.Create(&model.AccountUser{AccountID: account.ID, UserID: user.ID, Role: "administrator", CustomRoleID: role.ID}).Error)
+	_, err = svc.BuildPolicyContext(user.ID, account.ID)
+	require.Error(t, err)
+}
+
 func TestRBACService_CustomRoleConversationPermissionKeys(t *testing.T) {
 	pc := auth.NewPolicyContext(1, 1, "custom_role", 7, auth.PermissionMatrixMap{
 		auth.DimensionConversationUnassignedManage: auth.PermissionFull,
diff --git a/backend/internal/service/rbac_service.go b/backend/internal/service/rbac_service.go
index 27a70458..d642b864 100644
--- a/backend/internal/service/rbac_service.go
+++ b/backend/internal/service/rbac_service.go
@@ -15,6 +15,7 @@ import (
 	"fmt"
 
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 
 	"github.com/gochat/gochat/internal/auth"
 	"github.com/gochat/gochat/internal/model"
@@ -70,15 +71,14 @@ func (s *RBACService) GetAccountUser(userID, accountID uint) (*model.AccountUser
 // AddAccountUser adds a user to an account with a specified role.
 // This corresponds to Chatwoot's AccountUser creation during invitation flow.
 func (s *RBACService) AddAccountUser(userID, accountID uint, role string, customRoleID uint, invitedBy uint) (*model.AccountUser, error) {
-	// Validate role
 	if !isValidRole(role) {
 		return nil, fmt.Errorf("invalid role '%s': must be 'agent', 'administrator', or 'custom_role'", role)
 	}
-
-	// Check if user is already a member
-	existing, err := s.GetAccountUser(userID, accountID)
-	if err == nil && existing != nil {
-		return nil, fmt.Errorf("user %d is already a member of account %d", userID, accountID)
+	if role == "administrator" && customRoleID > 0 {
+		return nil, fmt.Errorf("invalid role assignment: administrator cannot have a custom role")
+	}
+	if role == "custom_role" && customRoleID == 0 {
+		return nil, fmt.Errorf("invalid role assignment: custom_role requires a custom role id")
 	}
 
 	au := &model.AccountUser{
@@ -89,11 +89,22 @@ func (s *RBACService) AddAccountUser(userID, accountID uint, role string, custom
 		Availability: "offline",
 		InvitedBy:    invitedBy,
 	}
-
-	if err := s.db.Create(au).Error; err != nil {
+	if err := s.db.Transaction(func(tx *gorm.DB) error {
+		if err := validateCustomRoleAssignment(tx, customRoleID, accountID); err != nil {
+			return err
+		}
+		var existing model.AccountUser
+		err := tx.Where("user_id = ? AND account_id = ?", userID, accountID).First(&existing).Error
+		if err == nil {
+			return fmt.Errorf("user %d is already a member of account %d", userID, accountID)
+		}
+		if !errors.Is(err, gorm.ErrRecordNotFound) {
+			return err
+		}
+		return tx.Create(au).Error
+	}); err != nil {
 		return nil, err
 	}
-
 	return au, nil
 }
 
@@ -102,20 +113,29 @@ func (s *RBACService) UpdateAccountUserRole(userID, accountID uint, newRole stri
 	if !isValidRole(newRole) {
 		return nil, fmt.Errorf("invalid role '%s'", newRole)
 	}
-
-	au, err := s.GetAccountUser(userID, accountID)
-	if err != nil {
-		return nil, err
+	if newRole == "administrator" && customRoleID > 0 {
+		return nil, fmt.Errorf("invalid role assignment: administrator cannot have a custom role")
+	}
+	if newRole == "custom_role" && customRoleID == 0 {
+		return nil, fmt.Errorf("invalid role assignment: custom_role requires a custom role id")
 	}
 
-	au.Role = normalizeAccountUserRole(newRole, customRoleID)
-	au.CustomRoleID = customRoleID
-
-	if err := s.db.Save(au).Error; err != nil {
+	var au model.AccountUser
+	if err := s.db.Transaction(func(tx *gorm.DB) error {
+		if err := validateCustomRoleAssignment(tx, customRoleID, accountID); err != nil {
+			return err
+		}
+		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).
+			Where("user_id = ? AND account_id = ?", userID, accountID).First(&au).Error; err != nil {
+			return err
+		}
+		au.Role = normalizeAccountUserRole(newRole, customRoleID)
+		au.CustomRoleID = customRoleID
+		return tx.Save(&au).Error
+	}); err != nil {
 		return nil, err
 	}
-
-	return au, nil
+	return &au, nil
 }
 
 // RemoveAccountUser removes a user from an account (soft delete).
@@ -203,12 +223,49 @@ func (s *RBACService) GetCustomRolePermissionMatrix(customRoleID uint) (auth.Per
 	if err != nil {
 		return nil, err
 	}
+	return customRolePermissionMatrix(cr)
+}
 
+// GetCustomRoleForAccount retrieves a live custom role scoped to an account.
+func (s *RBACService) GetCustomRoleForAccount(customRoleID, accountID uint) (*model.CustomRole, error) {
+	var cr model.CustomRole
+	if err := validateCustomRoleAssignment(s.db, customRoleID, accountID); err != nil {
+		return nil, err
+	}
+	if err := s.db.Where("id = ? AND account_id = ? AND deleted_at IS NULL", customRoleID, accountID).First(&cr).Error; err != nil {
+		return nil, err
+	}
+	return &cr, nil
+}
+
+func validateCustomRoleAssignment(db *gorm.DB, customRoleID, accountID uint) error {
+	if customRoleID == 0 {
+		return nil
+	}
+	var role model.CustomRole
+	err := db.Clauses(clause.Locking{Strength: "UPDATE"}).
+		Where("id = ? AND account_id = ? AND deleted_at IS NULL", customRoleID, accountID).
+		First(&role).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return fmt.Errorf("invalid custom role assignment: custom role %d not found for account %d", customRoleID, accountID)
+	}
+	return err
+}
+
+// GetCustomRolePermissionMatrixForAccount loads permissions only from a live role in the account.
+func (s *RBACService) GetCustomRolePermissionMatrixForAccount(customRoleID, accountID uint) (auth.PermissionMatrixMap, error) {
+	cr, err := s.GetCustomRoleForAccount(customRoleID, accountID)
+	if err != nil {
+		return nil, err
+	}
+	return customRolePermissionMatrix(cr)
+}
+
+func customRolePermissionMatrix(cr *model.CustomRole) (auth.PermissionMatrixMap, error) {
 	modelMap, err := cr.GetPermissionMap()
 	if err != nil {
 		return nil, err
 	}
-
 	return modelPermMapToAuthMatrix(modelMap), nil
 }
 
@@ -240,29 +297,23 @@ func (s *RBACService) UpdateCustomRole(customRoleID uint, name string, permissio
 }
 
 // DeleteCustomRole deletes a custom role (soft delete).
-// All AccountUsers referencing this role will be downgraded to agent role.
+// All AccountUsers referencing it revert to the standard agent role and permissions.
 func (s *RBACService) DeleteCustomRole(customRoleID uint) error {
-	// Downgrade all account users with this custom role to agent
-	err := s.db.Model(&model.AccountUser{}).
-		Where("custom_role_id = ?", customRoleID).
-		Updates(map[string]interface{}{
-			"role":           "agent",
-			"custom_role_id": 0,
-		}).Error
-	if err != nil {
-		return err
-	}
-
-	// Soft delete the custom role
-	result := s.db.Delete(&model.CustomRole{}, customRoleID)
-	if result.Error != nil {
-		return result.Error
-	}
-	if result.RowsAffected == 0 {
-		return fmt.Errorf("custom role %d not found", customRoleID)
-	}
-
-	return nil
+	return s.db.Transaction(func(tx *gorm.DB) error {
+		var role model.CustomRole
+		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).First(&role, customRoleID).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return fmt.Errorf("custom role %d not found", customRoleID)
+			}
+			return err
+		}
+		if err := tx.Model(&model.AccountUser{}).
+			Where("account_id = ? AND custom_role_id = ?", role.AccountID, customRoleID).
+			Updates(map[string]interface{}{"role": "agent", "custom_role_id": 0}).Error; err != nil {
+			return err
+		}
+		return tx.Delete(&role).Error
+	})
 }
 
 // ListCustomRoles retrieves all custom roles for an account.
@@ -282,6 +333,9 @@ func (s *RBACService) BuildPolicyContext(userID, accountID uint) (*auth.PolicyCo
 	if err != nil {
 		return nil, err
 	}
+	if au.Role == "administrator" && au.CustomRoleID > 0 {
+		return nil, fmt.Errorf("invalid role assignment: administrator cannot have a custom role")
+	}
 
 	permissions := auth.PermissionMatrixMap{}
 
@@ -293,29 +347,25 @@ func (s *RBACService) BuildPolicyContext(userID, accountID uint) (*auth.PolicyCo
 		permissions = auth.AdministratorPermissions
 	case "agent":
 		if au.CustomRoleID > 0 {
-			pm, err := s.GetCustomRolePermissionMatrix(au.CustomRoleID)
+			pm, err := s.GetCustomRolePermissionMatrixForAccount(au.CustomRoleID, accountID)
 			if err != nil {
-				// Fallback to agent defaults if custom role not found
-				permissions = auth.AgentDefaultPermissions
-			} else {
-				permissions = pm
-				effectiveRole = "custom_role"
+				return nil, fmt.Errorf("load custom role permissions: %w", err)
 			}
+			permissions = pm
+			effectiveRole = "custom_role"
 		} else {
 			permissions = auth.AgentDefaultPermissions
 		}
 	case "custom_role":
-		effectiveRole = "custom_role"
-		if au.CustomRoleID > 0 {
-			pm, err := s.GetCustomRolePermissionMatrix(au.CustomRoleID)
-			if err != nil {
-				permissions = auth.AgentDefaultPermissions
-			} else {
-				permissions = pm
-			}
-		} else {
-			permissions = auth.AgentDefaultPermissions
+		if au.CustomRoleID == 0 {
+			return nil, fmt.Errorf("custom role assignment is missing a role id")
 		}
+		pm, err := s.GetCustomRolePermissionMatrixForAccount(au.CustomRoleID, accountID)
+		if err != nil {
+			return nil, fmt.Errorf("load custom role permissions: %w", err)
+		}
+		permissions = pm
+		effectiveRole = "custom_role"
 	}
 
 	return auth.NewPolicyContext(userID, accountID, effectiveRole, au.CustomRoleID, permissions), nil
@@ -498,7 +548,12 @@ func (s *RBACService) GetAccountUserRole(userID, accountID uint) (string, uint,
 }
 
 // GetCustomRolePermissions returns the auth.PermissionMatrixMap for a custom role.
-// This implements the middleware.RBACLookup interface.
+// It is retained for callers that do not have an account scope.
 func (s *RBACService) GetCustomRolePermissions(customRoleID uint) (auth.PermissionMatrixMap, error) {
 	return s.GetCustomRolePermissionMatrix(customRoleID)
 }
+
+// GetCustomRolePermissionsForAccount implements the account-scoped middleware lookup.
+func (s *RBACService) GetCustomRolePermissionsForAccount(customRoleID, accountID uint) (auth.PermissionMatrixMap, error) {
+	return s.GetCustomRolePermissionMatrixForAccount(customRoleID, accountID)
+}
diff --git a/backend/scripts/parity_frontend_browser_smoke.mjs b/backend/scripts/parity_frontend_browser_smoke.mjs
index 7db31d0a..7885176d 100644
--- a/backend/scripts/parity_frontend_browser_smoke.mjs
+++ b/backend/scripts/parity_frontend_browser_smoke.mjs
@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { spawn } from 'node:child_process';
+import { spawn } from "node:child_process";
 import {
   closeSync,
   mkdirSync,
@@ -7,70 +7,110 @@ import {
   openSync,
   readFileSync,
   writeFileSync,
-} from 'node:fs';
-import { createServer } from 'node:http';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
+} from "node:fs";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import path from "node:path";
 
 const root = process.env.GOCHAT_ROOT || process.cwd();
-const chatwootDir = process.env.CHATWOOT_DIR || path.join(root, '..', 'docs', 'chatwoot');
-const logDir = process.env.GOCHAT_SMOKE_LOG_DIR || path.join(root, '.tmp/frontend-smoke');
-const apiHost = process.env.GOCHAT_SMOKE_API_HOST || '127.0.0.1';
-const apiPort = process.env.GOCHAT_SMOKE_API_PORT || '3000';
-const frontendHost = process.env.GOCHAT_SMOKE_FRONTEND_HOST || '127.0.0.1';
-const frontendPort = process.env.GOCHAT_SMOKE_FRONTEND_PORT || '3036';
+const frontendDir =
+  process.env.FRONTEND_DIR ||
+  process.env.CHATWOOT_DIR ||
+  path.join(root, "..", "frontend");
+const logDir =
+  process.env.GOCHAT_SMOKE_LOG_DIR || path.join(root, ".tmp/frontend-smoke");
+const apiHost = process.env.GOCHAT_SMOKE_API_HOST || "127.0.0.1";
+const apiPort = process.env.GOCHAT_SMOKE_API_PORT || "3000";
+const frontendHost = process.env.GOCHAT_SMOKE_FRONTEND_HOST || "127.0.0.1";
+const frontendPort = process.env.GOCHAT_SMOKE_FRONTEND_PORT || "3036";
 const shellHost = process.env.GOCHAT_SMOKE_SHELL_HOST || frontendHost;
-const shellPort = process.env.GOCHAT_SMOKE_SHELL_PORT || String(Number(frontendPort) + 1);
-const chromePath = process.env.GOCHAT_SMOKE_CHROME || '/usr/bin/google-chrome';
+const shellPort =
+  process.env.GOCHAT_SMOKE_SHELL_PORT || String(Number(frontendPort) + 1);
+const chromePath = process.env.GOCHAT_SMOKE_CHROME || "/usr/bin/google-chrome";
 const viteBaseURL = `http://${frontendHost}:${frontendPort}`;
 const frontendBaseURL = `http://${shellHost}:${shellPort}`;
 const apiBaseURL = `http://${apiHost}:${apiPort}`;
-const enterpriseMode = process.argv.includes('--enterprise');
+const enterpriseMode = process.argv.includes("--enterprise");
+const deploymentEnv = process.env.GOCHAT_SMOKE_DEPLOYMENT_ENV || "cloud";
+const installationName = process.env.GOCHAT_SMOKE_INSTALLATION_NAME || "GoChat";
+const expectedBilling =
+  (process.env.GOCHAT_SMOKE_EXPECT_BILLING ||
+    (deploymentEnv === "cloud" && installationName === "GoChat"
+      ? "true"
+      : "false")) === "true";
 
 function isSuccessfulRequest(request, substring) {
-  return request.url.includes(substring) && request.status >= 200 && request.status < 400;
+  return (
+    request.url.includes(substring) &&
+    request.status >= 200 &&
+    request.status < 400
+  );
 }
 
 function isFailedAPIRequest(request) {
   const isBackendAPI = request.url.includes(apiBaseURL);
-  const isShellProxiedAPI = request.url.startsWith(frontendBaseURL) && (
-    request.url.includes('/api/') ||
-    request.url.includes('/enterprise/') ||
-    request.url.includes('/public/') ||
-    request.url.includes('/auth/') ||
-    request.url.includes('/rails/')
-  );
-  if (!isBackendAPI && !isShellProxiedAPI || request.type === 'Preflight') return false;
-  const isNavigationAbort = request.type === 'Document' &&
-    ['net::ERR_ABORTED', 'net::ERR_FAILED'].includes(request.errorText);
-  return request.status >= 400 || request.status === 0 && !isNavigationAbort;
+  const isShellProxiedAPI =
+    request.url.startsWith(frontendBaseURL) &&
+    (request.url.includes("/api/") ||
+      request.url.includes("/enterprise/") ||
+      request.url.includes("/public/") ||
+      request.url.includes("/auth/") ||
+      request.url.includes("/rails/"));
+  if ((!isBackendAPI && !isShellProxiedAPI) || request.type === "Preflight")
+    return false;
+  const isNavigationAbort =
+    request.type === "Document" &&
+    ["net::ERR_ABORTED", "net::ERR_FAILED"].includes(request.errorText);
+  return request.status >= 400 || (request.status === 0 && !isNavigationAbort);
 }
 
-if (process.argv.includes('--self-test')) {
+if (process.argv.includes("--self-test")) {
   const apiURL = `${apiBaseURL}/api/v1/profile`;
   const checks = [
-    isSuccessfulRequest({ url: apiURL, status: 200 }, '/api/v1/profile'),
-    !isSuccessfulRequest({ url: apiURL, status: 500 }, '/api/v1/profile'),
-    isFailedAPIRequest({ url: apiURL, status: 0, type: 'Fetch', errorText: 'net::ERR_FAILED' }),
-    !isFailedAPIRequest({ url: apiURL, status: 0, type: 'Document', errorText: 'net::ERR_ABORTED' }),
-    !isFailedAPIRequest({ url: `${frontendBaseURL}/favicon.ico`, status: 404, type: 'Image' }),
+    isSuccessfulRequest({ url: apiURL, status: 200 }, "/api/v1/profile"),
+    !isSuccessfulRequest({ url: apiURL, status: 500 }, "/api/v1/profile"),
+    isFailedAPIRequest({
+      url: apiURL,
+      status: 0,
+      type: "Fetch",
+      errorText: "net::ERR_FAILED",
+    }),
+    !isFailedAPIRequest({
+      url: apiURL,
+      status: 0,
+      type: "Document",
+      errorText: "net::ERR_ABORTED",
+    }),
+    !isFailedAPIRequest({
+      url: `${frontendBaseURL}/favicon.ico`,
+      status: 404,
+      type: "Image",
+    }),
   ];
-  if (checks.some(check => !check)) throw new Error('browser smoke failure contract self-test failed');
-  console.log('browser smoke failure contract self-test: ok');
+  if (checks.some((check) => !check))
+    throw new Error("browser smoke failure contract self-test failed");
+  console.log("browser smoke failure contract self-test: ok");
   process.exit(0);
 }
 
 mkdirSync(logDir, { recursive: true });
 
-const seed = JSON.parse(readFileSync(path.join(logDir, 'seed.json'), 'utf8'));
-const widgetConfig = JSON.parse(readFileSync(path.join(logDir, 'widget_config.json'), 'utf8'));
-const signInHeaders = readFileSync(path.join(logDir, 'sign_in.headers'), 'utf8');
+const seed = JSON.parse(readFileSync(path.join(logDir, "seed.json"), "utf8"));
+const widgetConfig = JSON.parse(
+  readFileSync(path.join(logDir, "widget_config.json"), "utf8"),
+);
+const signInHeaders = readFileSync(
+  path.join(logDir, "sign_in.headers"),
+  "utf8",
+);
 const report = {
   started_at: new Date().toISOString(),
-  mode: enterpriseMode ? 'enterprise' : 'core',
+  mode: enterpriseMode ? "enterprise" : "core",
+  frontend_dir: frontendDir,
   frontend_base_url: frontendBaseURL,
   api_base_url: apiBaseURL,
   account_id: seed.account_id,
+  installation_name: installationName,
   requests: [],
   console: [],
   checks: [],
@@ -78,31 +118,28 @@ const report = {
 
 function smokeHTML(entrypoint, route) {
   const config = {
-    apiHost: '',
+    apiHost: "",
     hostURL: frontendBaseURL,
-    helpCenterURL: '',
-    allowedLoginMethods: ['email'],
-    signupEnabled: 'false',
-    isMfaEnabled: 'false',
-    enabledLanguages: [{ iso_639_1_code: 'en', name: 'English' }],
+    helpCenterURL: "",
+    allowedLoginMethods: ["email"],
+    signupEnabled: "false",
+    isMfaEnabled: "false",
+    enabledLanguages: [{ iso_639_1_code: "en", name: "English" }],
     helpUrls: {},
-    selectedLocale: 'en',
-    isEnterprise: 'true',
-    enterprisePlanName: 'enterprise',
+    selectedLocale: "en",
   };
   const globalConfig = {
-    INSTALLATION_NAME: 'GoChat',
-    BRAND_NAME: 'GoChat',
-    LOGO: '/logo.png',
-    LOGO_DARK: '',
-    LOGO_THUMBNAIL: '/logo.png',
-    DISABLE_USER_PROFILE_UPDATE: 'false',
-    DIRECT_UPLOADS_ENABLED: 'false',
-    MAXIMUM_FILE_UPLOAD_SIZE: '40',
+    INSTALLATION_NAME: installationName,
+    BRAND_NAME: "GoChat",
+    LOGO: "/logo.png",
+    LOGO_DARK: "",
+    LOGO_THUMBNAIL: "/logo.png",
+    DISABLE_USER_PROFILE_UPDATE: "false",
+    DIRECT_UPLOADS_ENABLED: "false",
+    MAXIMUM_FILE_UPLOAD_SIZE: "40",
     ACTIVE_PLATFORM_BANNERS: [],
-    LOGOUT_REDIRECT_LINK: '/app/login',
-    DEPLOYMENT_ENV: 'cloud',
-    IS_ENTERPRISE: 'true',
+    LOGOUT_REDIRECT_LINK: "/app/login",
+    DEPLOYMENT_ENV: deploymentEnv,
   };
   return `<!doctype html>
 <html>
@@ -112,6 +149,7 @@ function smokeHTML(entrypoint, route) {
     <title>GoChat Smoke</title>
     <script>
       history.replaceState({}, '', ${JSON.stringify(route)});
+      window.__GOCHAT_CONFIG__ = ${JSON.stringify({ ...config, globalConfig })};
       window.chatwootConfig = ${JSON.stringify(config)};
       window.globalConfig = ${JSON.stringify(globalConfig)};
       window.browserConfig = { browser_name: 'chrome' };
@@ -131,8 +169,8 @@ function widgetSmokeHTML(route) {
   const chatwootWebChannel = {
     ...websiteChannelConfig,
     websiteToken: websiteChannelConfig.website_token,
-    enabledLanguages: [{ iso_639_1_code: 'en', name: 'English' }],
-    locale: 'en',
+    enabledLanguages: [{ iso_639_1_code: "en", name: "English" }],
+    locale: "en",
     portal: null,
     hasAConnectedAgentBot: false,
     allowMessagesAfterResolved: true,
@@ -147,8 +185,8 @@ function widgetSmokeHTML(route) {
     <script>
       history.replaceState({}, '', ${JSON.stringify(route)});
       window.chatwootWebChannel = ${JSON.stringify(chatwootWebChannel)};
-      window.chatwootPubsubToken = ${JSON.stringify(contact.pubsub_token || websiteChannelConfig.auth_token || '')};
-      window.authToken = ${JSON.stringify(websiteChannelConfig.auth_token || contact.pubsub_token || '')};
+      window.chatwootPubsubToken = ${JSON.stringify(contact.pubsub_token || websiteChannelConfig.auth_token || "")};
+      window.authToken = ${JSON.stringify(websiteChannelConfig.auth_token || contact.pubsub_token || "")};
       window.globalConfig = ${JSON.stringify(globalConfig)};
       window.referrerURL = ${JSON.stringify(frontendBaseURL)};
       window.browserConfig = { browser_name: 'chrome' };
@@ -175,166 +213,198 @@ function writeWidgetSmokeShell(name, route) {
 function startSmokeShellServer() {
   const server = createServer(async (req, res) => {
     try {
-      const requestURL = new URL(req.url || '/', frontendBaseURL);
+      const requestURL = new URL(req.url || "/", frontendBaseURL);
       if (smokeShells.has(requestURL.pathname)) {
-        res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
         res.end(smokeShells.get(requestURL.pathname));
         return;
       }
-      if (requestURL.pathname.startsWith('/app/')) {
-        const entrypoint = requestURL.pathname === '/app/login' ? 'v3app' : 'dashboard';
-        res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
+      if (requestURL.pathname.startsWith("/app/")) {
+        const entrypoint =
+          requestURL.pathname === "/app/login" ? "v3app" : "dashboard";
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
         res.end(smokeHTML(entrypoint, requestURL.pathname));
         return;
       }
-      if (requestURL.pathname.startsWith('/vite-dev/')) {
-        const nonEnglishLocaleModule = requestURL.pathname.match(/^\/vite-dev\/dashboard\/i18n\/locale\/([^/]+)\/index\.js$/);
-        if (nonEnglishLocaleModule && nonEnglishLocaleModule[1] !== 'en') {
-          res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8' });
-          res.end('export default {};');
+      if (requestURL.pathname.startsWith("/vite-dev/")) {
+        const nonEnglishLocaleModule = requestURL.pathname.match(
+          /^\/vite-dev\/dashboard\/i18n\/locale\/([^/]+)\/index\.js$/,
+        );
+        if (nonEnglishLocaleModule && nonEnglishLocaleModule[1] !== "en") {
+          res.writeHead(200, {
+            "content-type": "text/javascript; charset=utf-8",
+          });
+          res.end("export default {};");
           return;
         }
-        const upstream = await fetch(`${viteBaseURL}${requestURL.pathname}${requestURL.search}`);
+        const upstream = await fetch(
+          `${viteBaseURL}${requestURL.pathname}${requestURL.search}`,
+        );
         const headers = Object.fromEntries(upstream.headers.entries());
-        headers['access-control-allow-origin'] = '*';
+        headers["access-control-allow-origin"] = "*";
         res.writeHead(upstream.status, headers);
         res.end(Buffer.from(await upstream.arrayBuffer()));
         return;
       }
       if (
-        requestURL.pathname.startsWith('/api/') ||
-        requestURL.pathname.startsWith('/enterprise/') ||
-        requestURL.pathname.startsWith('/public/') ||
-        requestURL.pathname.startsWith('/auth/') ||
-        requestURL.pathname.startsWith('/rails/')
+        requestURL.pathname.startsWith("/api/") ||
+        requestURL.pathname.startsWith("/enterprise/") ||
+        requestURL.pathname.startsWith("/public/") ||
+        requestURL.pathname.startsWith("/auth/") ||
+        requestURL.pathname.startsWith("/rails/")
       ) {
         const chunks = [];
         for await (const chunk of req) chunks.push(chunk);
-        const upstream = await fetch(`${apiBaseURL}${requestURL.pathname}${requestURL.search}`, {
-          method: req.method,
-          headers: req.headers,
-          body: ['GET', 'HEAD'].includes(req.method || 'GET') ? undefined : Buffer.concat(chunks),
-        });
+        const upstream = await fetch(
+          `${apiBaseURL}${requestURL.pathname}${requestURL.search}`,
+          {
+            method: req.method,
+            headers: req.headers,
+            body: ["GET", "HEAD"].includes(req.method || "GET")
+              ? undefined
+              : Buffer.concat(chunks),
+          },
+        );
         const headers = Object.fromEntries(upstream.headers.entries());
-        headers['access-control-allow-origin'] = '*';
+        headers["access-control-allow-origin"] = "*";
         res.writeHead(upstream.status, headers);
         res.end(Buffer.from(await upstream.arrayBuffer()));
         return;
       }
-      if (requestURL.pathname === '/sw.js') {
-        res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8' });
-        res.end('self.addEventListener("install", event => self.skipWaiting());');
+      if (requestURL.pathname === "/sw.js") {
+        res.writeHead(200, {
+          "content-type": "text/javascript; charset=utf-8",
+        });
+        res.end(
+          'self.addEventListener("install", event => self.skipWaiting());',
+        );
         return;
       }
-      if (requestURL.pathname === '/favicon.ico' || requestURL.pathname === '/logo.png') {
+      if (
+        requestURL.pathname === "/favicon.ico" ||
+        requestURL.pathname === "/logo.png"
+      ) {
         res.writeHead(204);
         res.end();
         return;
       }
-      res.writeHead(404, { 'content-type': 'text/plain' });
-      res.end('not found');
+      res.writeHead(404, { "content-type": "text/plain" });
+      res.end("not found");
     } catch (error) {
-      res.writeHead(502, { 'content-type': 'text/plain' });
+      res.writeHead(502, { "content-type": "text/plain" });
       res.end(error.message);
     }
   });
   return new Promise((resolve, reject) => {
-    server.once('error', reject);
+    server.once("error", reject);
     server.listen(Number(shellPort), shellHost, () => resolve(server));
   });
 }
 
 const smokePages = {
-  dashboard: writeSmokeShell('gochat-smoke-dashboard', 'dashboard', `/app/accounts/${seed.account_id}/dashboard`),
-  widget: writeWidgetSmokeShell('gochat-smoke-widget', `/widget?website_token=${encodeURIComponent(widgetConfig.website_channel_config?.website_token || 'gochat-smoke-widget-token')}#/messages`),
+  dashboard: writeSmokeShell(
+    "gochat-smoke-dashboard",
+    "dashboard",
+    `/app/accounts/${seed.account_id}/dashboard`,
+  ),
+  billing: `${frontendBaseURL}/app/accounts/${seed.account_id}/settings/billing`,
+  widget: writeWidgetSmokeShell(
+    "gochat-smoke-widget",
+    `/widget?website_token=${encodeURIComponent(widgetConfig.website_channel_config?.website_token || "gochat-smoke-widget-token")}#/messages`,
+  ),
 };
 
 function headerValue(headers, name) {
   const needle = `${name.toLowerCase()}:`;
-  const line = headers.split(/\r?\n/).find(header => header.toLowerCase().startsWith(needle));
-  return line ? line.slice(line.indexOf(':') + 1).trim() : '';
+  const line = headers
+    .split(/\r?\n/)
+    .find((header) => header.toLowerCase().startsWith(needle));
+  return line ? line.slice(line.indexOf(":") + 1).trim() : "";
 }
 
 const sessionCookie = JSON.stringify({
-  'access-token': headerValue(signInHeaders, 'access-token'),
-  client: headerValue(signInHeaders, 'client'),
-  uid: headerValue(signInHeaders, 'uid'),
-  'token-type': headerValue(signInHeaders, 'token-type') || 'Bearer',
+  "access-token": headerValue(signInHeaders, "access-token"),
+  client: headerValue(signInHeaders, "client"),
+  uid: headerValue(signInHeaders, "uid"),
+  "token-type": headerValue(signInHeaders, "token-type") || "Bearer",
 });
 
 const enterprisePages = [
   {
-    label: 'SLA reports screen',
-    name: 'gochat-smoke-enterprise-sla-reports',
+    label: "SLA reports screen",
+    name: "gochat-smoke-enterprise-sla-reports",
     route: `/app/accounts/${seed.account_id}/reports/sla`,
-    requests: ['/applied_slas', '/applied_slas/metrics'],
+    requests: ["/applied_slas", "/applied_slas/metrics"],
   },
   {
-    label: 'CSAT reports screen',
-    name: 'gochat-smoke-enterprise-csat-reports',
+    label: "CSAT reports screen",
+    name: "gochat-smoke-enterprise-csat-reports",
     route: `/app/accounts/${seed.account_id}/reports/csat`,
-    requests: ['/csat_survey_responses', '/csat_survey_responses/metrics'],
+    requests: ["/csat_survey_responses", "/csat_survey_responses/metrics"],
   },
   {
-    label: 'automation rules screen',
-    name: 'gochat-smoke-enterprise-automation',
+    label: "automation rules screen",
+    name: "gochat-smoke-enterprise-automation",
     route: `/app/accounts/${seed.account_id}/settings/automation/list`,
-    requests: ['/automation_rules'],
+    requests: ["/automation_rules"],
   },
   {
-    label: 'macros screen',
-    name: 'gochat-smoke-enterprise-macros',
+    label: "macros screen",
+    name: "gochat-smoke-enterprise-macros",
     route: `/app/accounts/${seed.account_id}/settings/macros`,
-    requests: ['/macros'],
+    requests: ["/macros"],
   },
   {
-    label: 'audit logs screen',
-    name: 'gochat-smoke-enterprise-audit-logs',
+    label: "audit logs screen",
+    name: "gochat-smoke-enterprise-audit-logs",
     route: `/app/accounts/${seed.account_id}/settings/audit-logs/list`,
-    requests: ['/audit_logs'],
+    requests: ["/audit_logs"],
   },
   {
-    label: 'custom roles screen',
-    name: 'gochat-smoke-enterprise-custom-roles',
+    label: "custom roles screen",
+    name: "gochat-smoke-enterprise-custom-roles",
     route: `/app/accounts/${seed.account_id}/settings/custom-roles/list`,
-    requests: ['/custom_roles'],
+    requests: ["/custom_roles"],
   },
   {
-    label: 'notifications screen',
-    name: 'gochat-smoke-enterprise-notifications',
+    label: "notifications screen",
+    name: "gochat-smoke-enterprise-notifications",
     route: `/app/accounts/${seed.account_id}/notifications`,
     requests: [`/api/v1/accounts/${seed.account_id}/notifications?page=1`],
   },
   {
-    label: 'profile notification preferences screen',
-    name: 'gochat-smoke-enterprise-profile-notification-preferences',
+    label: "profile notification preferences screen",
+    name: "gochat-smoke-enterprise-profile-notification-preferences",
     route: `/app/accounts/${seed.account_id}/profile/settings`,
     requests: [
       `/api/v1/accounts/${seed.account_id}/notification_settings`,
-      '/api/v1/profile/sessions',
+      "/api/v1/profile/sessions",
     ],
   },
   {
-    label: 'agent capacity screen',
-    name: 'gochat-smoke-enterprise-agent-capacity',
+    label: "agent capacity screen",
+    name: "gochat-smoke-enterprise-agent-capacity",
     route: `/app/accounts/${seed.account_id}/settings/assignment-policy/capacity`,
-    requests: ['/agent_capacity_policies'],
+    requests: ["/agent_capacity_policies"],
   },
   {
-    label: 'agent capacity edit screen',
-    name: 'gochat-smoke-enterprise-agent-capacity-edit',
+    label: "agent capacity edit screen",
+    name: "gochat-smoke-enterprise-agent-capacity-edit",
     route: `/app/accounts/${seed.account_id}/settings/assignment-policy/capacity/edit/${seed.capacity_policy_id}`,
-    requests: [`/agent_capacity_policies/${seed.capacity_policy_id}`, `/agent_capacity_policies/${seed.capacity_policy_id}/users`],
+    requests: [
+      `/agent_capacity_policies/${seed.capacity_policy_id}`,
+      `/agent_capacity_policies/${seed.capacity_policy_id}/users`,
+    ],
   },
   {
-    label: 'Captain settings screen',
-    name: 'gochat-smoke-enterprise-captain-settings',
+    label: "Captain settings screen",
+    name: "gochat-smoke-enterprise-captain-settings",
     route: `/app/accounts/${seed.account_id}/settings/captain`,
-    requests: ['/captain/preferences'],
+    requests: ["/captain/preferences"],
   },
   {
-    label: 'Captain assistant overview screen',
-    name: 'gochat-smoke-enterprise-captain-overview',
+    label: "Captain assistant overview screen",
+    name: "gochat-smoke-enterprise-captain-overview",
     route: `/app/accounts/${seed.account_id}/captain/${seed.captain_assistant_id}/overview`,
     requests: [
       `/captain/assistants/${seed.captain_assistant_id}/stats`,
@@ -342,8 +412,8 @@ const enterprisePages = [
     ],
   },
   {
-    label: 'billing screen',
-    name: 'gochat-smoke-enterprise-billing',
+    label: "billing screen",
+    name: "gochat-smoke-enterprise-billing",
     route: `/app/accounts/${seed.account_id}/settings/billing`,
     requests: [
       `/enterprise/api/v1/accounts/${seed.account_id}/subscription`,
@@ -351,14 +421,14 @@ const enterprisePages = [
     ],
   },
   {
-    label: 'voice inbox settings screen',
-    name: 'gochat-smoke-enterprise-voice-inbox',
+    label: "voice inbox settings screen",
+    name: "gochat-smoke-enterprise-voice-inbox",
     route: `/app/accounts/${seed.account_id}/settings/inboxes/${seed.voice_inbox_id}/voice-configuration`,
     requests: [`/api/v1/accounts/${seed.account_id}/inboxes`],
   },
-].map(page => ({
+].map((page) => ({
   ...page,
-  url: writeSmokeShell(page.name, 'dashboard', page.route),
+  url: writeSmokeShell(page.name, "dashboard", page.route),
 }));
 
 class CDPPage {
@@ -369,7 +439,7 @@ class CDPPage {
     this.pending = new Map();
     this.listeners = new Map();
     this.requestURLs = new Map();
-    ws.onmessage = event => this.handleMessage(JSON.parse(event.data));
+    ws.onmessage = (event) => this.handleMessage(JSON.parse(event.data));
   }
 
   handleMessage(message) {
@@ -381,7 +451,7 @@ class CDPPage {
       return;
     }
     const handlers = this.listeners.get(message.method) || [];
-    handlers.forEach(handler => handler(message.params || {}));
+    handlers.forEach((handler) => handler(message.params || {}));
   }
 
   send(method, params = {}) {
@@ -405,31 +475,36 @@ class CDPPage {
   }
 
   async init() {
-    await this.send('Page.enable');
-    await this.send('Runtime.enable');
-    await this.send('Network.enable');
-    this.on('Network.requestWillBeSent', params => {
+    await this.send("Page.enable");
+    await this.send("Runtime.enable");
+    await this.send("Network.enable");
+    this.on("Network.requestWillBeSent", (params) => {
       if (params.requestId && params.request?.url) {
         this.requestURLs.set(params.requestId, params.request.url);
       }
     });
-    this.on('Runtime.consoleAPICalled', params => {
+    this.on("Runtime.consoleAPICalled", (params) => {
       report.console.push({
         type: params.type,
-        text: (params.args || []).map(arg => arg.value || arg.description || '').join(' '),
+        text: (params.args || [])
+          .map((arg) => arg.value || arg.description || "")
+          .join(" "),
       });
     });
-    this.on('Runtime.exceptionThrown', params => {
-      report.console.push({ type: 'exception', text: params.exceptionDetails?.text || 'exception' });
+    this.on("Runtime.exceptionThrown", (params) => {
+      report.console.push({
+        type: "exception",
+        text: params.exceptionDetails?.text || "exception",
+      });
     });
-    this.on('Network.responseReceived', params => {
+    this.on("Network.responseReceived", (params) => {
       report.requests.push({
         url: params.response.url,
         status: params.response.status,
         type: params.type,
       });
     });
-    this.on('Network.loadingFailed', params => {
+    this.on("Network.loadingFailed", (params) => {
       report.requests.push({
         url: this.requestURLs.get(params.requestId) || params.requestId,
         status: 0,
@@ -440,19 +515,23 @@ class CDPPage {
   }
 
   async navigate(url) {
-    const loaded = new Promise(resolve => this.on('Page.loadEventFired', resolve));
-    await this.send('Page.navigate', { url });
+    const loaded = new Promise((resolve) =>
+      this.on("Page.loadEventFired", resolve),
+    );
+    await this.send("Page.navigate", { url });
     await loaded;
   }
 
   async eval(expression) {
-    const result = await this.send('Runtime.evaluate', {
+    const result = await this.send("Runtime.evaluate", {
       expression,
       awaitPromise: true,
       returnByValue: true,
     });
     if (result.exceptionDetails) {
-      throw new Error(result.exceptionDetails.text || 'Runtime.evaluate failed');
+      throw new Error(
+        result.exceptionDetails.text || "Runtime.evaluate failed",
+      );
     }
     return result.result?.value;
   }
@@ -461,10 +540,10 @@ class CDPPage {
     const start = Date.now();
     while (Date.now() - start < timeout) {
       if (await this.eval(expression)) {
-        report.checks.push({ label, status: 'passed' });
+        report.checks.push({ label, status: "passed" });
         return;
       }
-      await new Promise(resolve => setTimeout(resolve, 250));
+      await new Promise((resolve) => setTimeout(resolve, 250));
     }
     throw new Error(`Timed out waiting for ${label}`);
   }
@@ -474,7 +553,7 @@ class CDPPage {
       await this.waitFor(
         'document.querySelector("#app") && document.querySelector("#app").children.length > 0',
         label,
-        timeout
+        timeout,
       );
     } catch (error) {
       const state = await this.eval(`JSON.stringify({
@@ -484,7 +563,7 @@ class CDPPage {
         appChildCount: document.querySelector('#app')?.children?.length || 0,
         title: document.title,
       })`);
-      report.console.push({ type: 'diagnostic', text: `${label}: ${state}` });
+      report.console.push({ type: "diagnostic", text: `${label}: ${state}` });
       throw error;
     }
   }
@@ -493,7 +572,7 @@ class CDPPage {
     return this.waitFor(
       `performance.getEntriesByType('resource').some(entry => entry.name.includes(${JSON.stringify(substring)}))`,
       label,
-      timeout
+      timeout,
     );
   }
 
@@ -501,65 +580,88 @@ class CDPPage {
     return this.waitForSuccessfulRequestAfter(substring, 0, label, timeout);
   }
 
-  async waitForSuccessfulRequestAfter(substring, requestIndex, label, timeout = 30000) {
+  async waitForSuccessfulRequestAfter(
+    substring,
+    requestIndex,
+    label,
+    timeout = 30000,
+  ) {
     const start = Date.now();
     while (Date.now() - start < timeout) {
-      if (report.requests.slice(requestIndex).some(request => isSuccessfulRequest(request, substring))) {
-        report.checks.push({ label, status: 'passed' });
+      if (
+        report.requests
+          .slice(requestIndex)
+          .some((request) => isSuccessfulRequest(request, substring))
+      ) {
+        report.checks.push({ label, status: "passed" });
         return;
       }
-      await new Promise(resolve => setTimeout(resolve, 250));
+      await new Promise((resolve) => setTimeout(resolve, 250));
     }
     throw new Error(`Timed out waiting for ${label}`);
   }
 
   assertNoFailedAPIRequests(requestIndex = 0) {
-    const failures = report.requests.slice(requestIndex).filter(isFailedAPIRequest);
+    const failures = report.requests
+      .slice(requestIndex)
+      .filter(isFailedAPIRequest);
     if (failures.length > 0) {
-      throw new Error(`Frontend API requests failed: ${failures.map(request => `${request.status} ${request.url}`).join('; ')}`);
+      throw new Error(
+        `Frontend API requests failed: ${failures.map((request) => `${request.status} ${request.url}`).join("; ")}`,
+      );
     }
-    report.checks.push({ label: 'no failed frontend API requests', status: 'passed' });
+    report.checks.push({
+      label: "no failed frontend API requests",
+      status: "passed",
+    });
   }
 
   async close() {
     this.ws.close();
-    this.chrome.kill('SIGTERM');
+    this.chrome.kill("SIGTERM");
   }
 }
 
 async function launchChrome() {
-  if (typeof WebSocket !== 'function') {
-    throw new Error('Node.js WebSocket API is unavailable; use --experimental-websocket');
+  if (typeof WebSocket !== "function") {
+    throw new Error(
+      "Node.js WebSocket API is unavailable; use --experimental-websocket",
+    );
   }
-  const userDataDir = mkdtempSync(path.join(tmpdir(), 'gochat-chrome-'));
+  const userDataDir = mkdtempSync(path.join(tmpdir(), "gochat-chrome-"));
   const args = [
-    '--headless=new',
-    '--disable-gpu',
-    '--no-first-run',
-    '--no-default-browser-check',
-    '--disable-dev-shm-usage',
-    '--enable-logging=stderr',
-    '--remote-debugging-port=0',
+    "--headless=new",
+    "--disable-gpu",
+    "--no-first-run",
+    "--no-default-browser-check",
+    "--disable-dev-shm-usage",
+    "--enable-logging=stderr",
+    "--remote-debugging-port=0",
     `--user-data-dir=${userDataDir}`,
   ];
-  if (process.env.CI) args.push('--no-sandbox');
-  args.push('about:blank');
-  const chromeLogPath = path.join(logDir, 'chrome.log');
-  const chromeLog = openSync(chromeLogPath, 'w');
-  const chrome = spawn(chromePath, args, { stdio: ['ignore', 'ignore', chromeLog] });
+  if (process.env.CI) args.push("--no-sandbox");
+  args.push("about:blank");
+  const chromeLogPath = path.join(logDir, "chrome.log");
+  const chromeLog = openSync(chromeLogPath, "w");
+  const chrome = spawn(chromePath, args, {
+    stdio: ["ignore", "ignore", chromeLog],
+  });
   closeSync(chromeLog);
-  let chromeFailure = '';
-  chrome.once('error', error => {
+  let chromeFailure = "";
+  chrome.once("error", (error) => {
     chromeFailure = `failed to launch Chrome: ${error.message}`;
   });
-  chrome.once('exit', (code, signal) => {
+  chrome.once("exit", (code, signal) => {
     chromeFailure = `Chrome exited before DevTools was ready (code=${code}, signal=${signal})`;
   });
-  const portFile = path.join(userDataDir, 'DevToolsActivePort');
+  const portFile = path.join(userDataDir, "DevToolsActivePort");
   for (let i = 0; i < 80; i += 1) {
     try {
-      const [port] = readFileSync(portFile, 'utf8').trim().split('\n');
-      const target = await fetch(`http://127.0.0.1:${port}/json/new?about:blank`, { method: 'PUT' }).then(r => r.json());
+      const [port] = readFileSync(portFile, "utf8").trim().split("\n");
+      const target = await fetch(
+        `http://127.0.0.1:${port}/json/new?about:blank`,
+        { method: "PUT" },
+      ).then((r) => r.json());
       const ws = new WebSocket(target.webSocketDebuggerUrl);
       await new Promise((resolve, reject) => {
         ws.onopen = resolve;
@@ -570,37 +672,80 @@ async function launchChrome() {
       return page;
     } catch {
       if (chromeFailure) break;
-      await new Promise(resolve => setTimeout(resolve, 250));
+      await new Promise((resolve) => setTimeout(resolve, 250));
     }
   }
-  chrome.kill('SIGTERM');
-  throw new Error(`${chromeFailure || 'Chrome DevTools did not become ready'}; see ${chromeLogPath}`);
+  chrome.kill("SIGTERM");
+  throw new Error(
+    `${chromeFailure || "Chrome DevTools did not become ready"}; see ${chromeLogPath}`,
+  );
 }
 
 async function main() {
   const shellServer = await startSmokeShellServer();
   const page = await launchChrome();
   try {
-    await page.send('Network.setCookie', {
-      name: 'cw_d_session_info',
+    await page.send("Network.setCookie", {
+      name: "cw_d_session_info",
       value: encodeURIComponent(sessionCookie),
       url: frontendBaseURL,
-      path: '/',
+      path: "/",
     });
 
     await page.navigate(smokePages.dashboard);
-    await page.waitForAppMounted('dashboard app mounted');
-    await page.waitForSuccessfulRequest('/auth/validate_token', 'dashboard validates auth token');
-    await page.waitForSuccessfulRequest(`/api/v1/accounts/${seed.account_id}/conversations`, 'dashboard requests conversations');
+    await page.waitForAppMounted("dashboard app mounted");
+    await page.waitForSuccessfulRequest(
+      "/auth/validate_token",
+      "dashboard validates auth token",
+    );
+    await page.waitForSuccessfulRequest(
+      `/api/v1/accounts/${seed.account_id}/conversations`,
+      "dashboard requests conversations",
+    );
     page.assertNoFailedAPIRequests();
 
+    const billingLinkVisible = await page.eval(
+      `Boolean(document.querySelector('a[href*="/settings/billing"]'))`,
+    );
+    if (billingLinkVisible !== expectedBilling) {
+      throw new Error(
+        `Billing sidebar visibility mismatch: expected ${expectedBilling}, got ${billingLinkVisible}`,
+      );
+    }
+    report.checks.push({
+      label: `Billing sidebar visibility (${deploymentEnv})`,
+      status: "passed",
+    });
+
+    const billingRequestIndex = report.requests.length;
+    await page.navigate(smokePages.billing);
+    await page.waitForAppMounted("billing route app mounted");
+    await page.waitFor(
+      `location.pathname.includes('/settings/billing') === ${expectedBilling}`,
+      `Billing direct-route guard (${deploymentEnv})`,
+    );
+    page.assertNoFailedAPIRequests(billingRequestIndex);
+    await page.navigate(smokePages.dashboard);
+    await page.waitForAppMounted("dashboard remounted after billing route");
+
     const widgetRequestIndex = report.requests.length;
     await page.navigate(smokePages.widget);
-    await page.waitForAppMounted('widget app mounted');
-    await page.waitForSuccessfulRequest('/api/v1/widget/messages', 'widget requests messages');
-    await page.waitForSuccessfulRequest('/api/v1/widget/inbox_members', 'widget requests inbox members');
-    await page.eval(`fetch('/api/v1/widget/campaigns?website_token=${encodeURIComponent(widgetConfig.website_channel_config?.website_token || 'gochat-smoke-widget-token')}').then(response => response.ok)`);
-    await page.waitForSuccessfulRequest('/api/v1/widget/campaigns', 'widget campaigns endpoint works');
+    await page.waitForAppMounted("widget app mounted");
+    await page.waitForSuccessfulRequest(
+      "/api/v1/widget/messages",
+      "widget requests messages",
+    );
+    await page.waitForSuccessfulRequest(
+      "/api/v1/widget/inbox_members",
+      "widget requests inbox members",
+    );
+    await page.eval(
+      `fetch('/api/v1/widget/campaigns?website_token=${encodeURIComponent(widgetConfig.website_channel_config?.website_token || "gochat-smoke-widget-token")}').then(response => response.ok)`,
+    );
+    await page.waitForSuccessfulRequest(
+      "/api/v1/widget/campaigns",
+      "widget campaigns endpoint works",
+    );
     page.assertNoFailedAPIRequests(widgetRequestIndex);
 
     if (enterpriseMode) {
@@ -609,7 +754,11 @@ async function main() {
         await page.navigate(enterprisePage.url);
         await page.waitForAppMounted(`${enterprisePage.label} app mounted`);
         for (const request of enterprisePage.requests) {
-          await page.waitForSuccessfulRequestAfter(request, requestIndex, `${enterprisePage.label} requests ${request}`);
+          await page.waitForSuccessfulRequestAfter(
+            request,
+            requestIndex,
+            `${enterprisePage.label} requests ${request}`,
+          );
         }
         page.assertNoFailedAPIRequests(requestIndex);
       }
@@ -629,24 +778,43 @@ async function main() {
         })(),
         body: JSON.stringify({ message: 'B12 enterprise browser copilot smoke', assistant_id: ${Number(seed.captain_assistant_id)}, conversation_id: ${Number(seed.conversation_id)} })
       }).then(response => response.ok)`);
-      await page.waitForSuccessfulRequestAfter('/captain/copilot_threads', copilotRequestIndex, 'browser context requests Copilot threads');
+      await page.waitForSuccessfulRequestAfter(
+        "/captain/copilot_threads",
+        copilotRequestIndex,
+        "browser context requests Copilot threads",
+      );
       page.assertNoFailedAPIRequests(copilotRequestIndex);
     }
+    const runtimeExceptions = report.console.filter(
+      (entry) => entry.type === "exception",
+    );
+    if (runtimeExceptions.length > 0) {
+      throw new Error(
+        `Browser runtime exceptions: ${runtimeExceptions.map((entry) => entry.text).join("; ")}`,
+      );
+    }
+    report.checks.push({
+      label: "no browser runtime exceptions",
+      status: "passed",
+    });
     report.finished_at = new Date().toISOString();
-    report.status = 'passed';
+    report.status = "passed";
   } catch (error) {
     report.finished_at = new Date().toISOString();
-    report.status = 'failed';
+    report.status = "failed";
     report.error = error.message;
     throw error;
   } finally {
-    writeFileSync(path.join(logDir, 'browser-smoke-report.json'), JSON.stringify(report, null, 2));
+    writeFileSync(
+      path.join(logDir, "browser-smoke-report.json"),
+      JSON.stringify(report, null, 2),
+    );
     await page.close();
-    await new Promise(resolve => shellServer.close(resolve));
+    await new Promise((resolve) => shellServer.close(resolve));
   }
 }
 
-main().catch(error => {
+main().catch((error) => {
   console.error(error.message);
   process.exit(1);
 });
diff --git a/backend/scripts/parity_frontend_smoke.sh b/backend/scripts/parity_frontend_smoke.sh
index 3589a8a1..6a2b7456 100755
--- a/backend/scripts/parity_frontend_smoke.sh
+++ b/backend/scripts/parity_frontend_smoke.sh
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# Repeatable B12 smoke harness for running the reused Chatwoot frontend against GoChat.
+# Repeatable B12 smoke harness for running the GoChat frontend against GoChat.
 
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-CHATWOOT_DIR="${CHATWOOT_DIR:-$ROOT/../docs/chatwoot}"
+CHATWOOT_DIR="${CHATWOOT_DIR:-$ROOT/../frontend}"
 LOG_DIR="${GOCHAT_SMOKE_LOG_DIR:-$ROOT/.tmp/frontend-smoke}"
 REPORT_PATH="${GOCHAT_SMOKE_REPORT:-$ROOT/../docs/parity/frontend-smoke-report.md}"
 API_HOST="${GOCHAT_SMOKE_API_HOST:-127.0.0.1}"
@@ -26,14 +26,14 @@ Modes:
   --check      Validate local prerequisites and write a readiness report.
   --print      Print the exact boot commands without starting processes.
   --boot-only  Start GoChat and Vite, verify /health and frontend HTTP, then exit.
-  --api-smoke  Run seed plus Chatwoot-frontend API assertions against a running GoChat backend.
-  --browser-smoke Run API smoke, then drive the reused Chatwoot frontend in headless Chrome.
+  --api-smoke  Run seed plus GoChat-frontend API assertions against a running GoChat backend.
+  --browser-smoke Run API smoke, then drive the GoChat frontend in headless Chrome.
   --enterprise-smoke Run API smoke plus enterprise feature API assertions against GoChat.
-  --enterprise-browser-smoke Run enterprise smoke, then navigate reused Chatwoot enterprise screens in headless Chrome.
+  --enterprise-browser-smoke Run enterprise smoke, then navigate GoChat enterprise screens in headless Chrome.
   --no-seed    Skip seed during --api-smoke and use GOCHAT_SEED_* values already present in DB.
 
 Environment:
-  CHATWOOT_DIR                  Chatwoot checkout path. Default: ../docs/chatwoot (4.15.1 upstream source)
+  CHATWOOT_DIR                  Frontend checkout path. Default: ../frontend
   GOCHAT_SMOKE_API_PORT         GoChat backend port. Default: 3000
   GOCHAT_SMOKE_FRONTEND_HOST    Vite frontend host. Default: localhost
   GOCHAT_SMOKE_FRONTEND_PORT    Vite frontend port. Default: 3036
@@ -44,6 +44,9 @@ Environment:
   GOCHAT_SMOKE_MEILI_API_KEY    Meilisearch API key. Default: gochat_dev
   GOCHAT_SMOKE_READY_TIMEOUT_SECONDS Readiness wait timeout. Default: 180
   GOCHAT_SMOKE_CHROME           Chrome binary for browser smoke. Default: /usr/bin/google-chrome
+  GOCHAT_SMOKE_DEPLOYMENT_ENV    Browser fixture deployment environment. Default: cloud
+  GOCHAT_SMOKE_INSTALLATION_NAME Browser fixture installation name. Default: GoChat
+  GOCHAT_SMOKE_EXPECT_BILLING    Expected Billing visibility (true/false); defaults from cloud/custom-brand matrix.
 USAGE
 }
 
@@ -51,21 +54,28 @@ RUN_SEED="true"
 
 for arg in "$@"; do
   case "$arg" in
-    --check) MODE="check" ;;
-    --print) MODE="print" ;;
-    --boot-only) KEEP_ALIVE="false" ;;
-    --api-smoke) MODE="api-smoke" ;;
-    --browser-smoke) MODE="browser-smoke" ;;
-    --enterprise-smoke) MODE="enterprise-smoke" ;;
-    --enterprise-browser-smoke) MODE="enterprise-browser-smoke" ;;
-    --no-seed) RUN_SEED="false" ;;
-    -h|--help) usage; exit 0 ;;
-    *) echo "unknown argument: $arg" >&2; usage; exit 2 ;;
+  --check) MODE="check" ;;
+  --print) MODE="print" ;;
+  --boot-only) KEEP_ALIVE="false" ;;
+  --api-smoke) MODE="api-smoke" ;;
+  --browser-smoke) MODE="browser-smoke" ;;
+  --enterprise-smoke) MODE="enterprise-smoke" ;;
+  --enterprise-browser-smoke) MODE="enterprise-browser-smoke" ;;
+  --no-seed) RUN_SEED="false" ;;
+  -h | --help)
+    usage
+    exit 0
+    ;;
+  *)
+    echo "unknown argument: $arg" >&2
+    usage
+    exit 2
+    ;;
   esac
 done
 
 backend_cmd=(env GOCHAT_ENV=development GOCHAT_SERVER_HOST="$API_HOST" GOCHAT_SERVER_PORT="$API_PORT" GOCHAT_SERVER_MODE=debug GOCHAT_SEARCH_ENGINE="$SEARCH_ENGINE" GOCHAT_SEARCH_HOST="$MEILI_HOST" GOCHAT_SEARCH_API_KEY="$MEILI_API_KEY" go run ./cmd/gochat serve)
-frontend_cmd=(env CHATWOOT_API_HOST="http://$API_HOST:$API_PORT" pnpm exec vite --host "$FRONTEND_HOST" --port "$FRONTEND_PORT")
+frontend_cmd=(env VITE_API_HOST="http://$API_HOST:$API_PORT" pnpm exec vite --host "$FRONTEND_HOST" --port "$FRONTEND_PORT")
 
 need() {
   if ! command -v "$1" >/dev/null 2>&1; then
@@ -124,10 +134,11 @@ scripts/parity_frontend_smoke.sh --enterprise-browser-smoke
 - Search: \`$SEARCH_ENGINE\` at \`$MEILI_HOST\`
 - Log: \`$LOG_DIR/gochat.log\`
 
-## Reused Chatwoot Frontend
+## GoChat Frontend
 
 - URL: http://$FRONTEND_HOST:$FRONTEND_PORT
 - Source: \`$CHATWOOT_DIR\`
+- Deployment fixture: \`${GOCHAT_SMOKE_DEPLOYMENT_ENV:-cloud}\`
 - Command: \`(cd $CHATWOOT_DIR && ${frontend_cmd[*]})\`
 - Log: \`$LOG_DIR/chatwoot-vite.log\`
 
@@ -148,7 +159,7 @@ The seed command creates deterministic login/account/inbox/contact/company/conve
 | Area | Current result | Owner if failing |
 | --- | --- | --- |
 | Boot GoChat backend | ${BOOT_BACKEND_RESULT:-Not run in check mode} | B12.1 |
-| Boot reused Chatwoot Vite frontend | ${BOOT_FRONTEND_RESULT:-Not run in check mode} | B12.1 |
+| Boot GoChat Vite frontend | ${BOOT_FRONTEND_RESULT:-Not run in check mode} | B12.1 |
 | Auth/profile | ${AUTH_PROFILE_RESULT:-Pending browser/API smoke} | B2/B12.2 |
 | Inbox list/settings | ${INBOX_RESULT:-Pending browser/API smoke} | B5/B12.2 |
 | Conversation list/detail/message send | ${CONVERSATION_RESULT:-Pending browser/API smoke} | B3/B12.2 |
@@ -173,9 +184,18 @@ check_prereqs() {
   need curl
   need node
   need pnpm
-  test -d "$CHATWOOT_DIR" || { echo "missing Chatwoot checkout: $CHATWOOT_DIR" >&2; return 1; }
-  test -f "$CHATWOOT_DIR/package.json" || { echo "missing Chatwoot package.json" >&2; return 1; }
-  test -f "$ROOT/cmd/gochat/main.go" || { echo "missing GoChat server entrypoint cmd/gochat/main.go" >&2; return 1; }
+  test -d "$CHATWOOT_DIR" || {
+    echo "missing Chatwoot checkout: $CHATWOOT_DIR" >&2
+    return 1
+  }
+  test -f "$CHATWOOT_DIR/package.json" || {
+    echo "missing Chatwoot package.json" >&2
+    return 1
+  }
+  test -f "$ROOT/cmd/gochat/main.go" || {
+    echo "missing GoChat server entrypoint cmd/gochat/main.go" >&2
+    return 1
+  }
 }
 
 wait_url() {
@@ -464,40 +484,40 @@ SEED
   fi
 
   BOOT_BACKEND_RESULT="Passed /health during API smoke" \
-  AUTH_PROFILE_RESULT="Passed API smoke" \
-  INBOX_RESULT="Passed API smoke" \
-  CONVERSATION_RESULT="Passed API smoke" \
-  CRM_RESULT="Passed contact/company API smoke" \
-  SEARCH_RESULT="Passed search API smoke" \
-  WIDGET_RESULT="Passed API smoke" \
-  CSAT_RESULT="Passed public show API smoke" \
-  ENTERPRISE_RESULT="Pending B12.3 browser/API smoke" \
-  write_report "API smoke passed for reused Chatwoot frontend core paths; live browser smoke not run in this mode." "Command run: \`scripts/parity_frontend_smoke.sh --api-smoke\`. Logs and payload captures are under \`$LOG_DIR\`. B12.2 still needs browser navigation assertions for the reused Vite app, and B12.3 must add enterprise screen assertions."
+    AUTH_PROFILE_RESULT="Passed API smoke" \
+    INBOX_RESULT="Passed API smoke" \
+    CONVERSATION_RESULT="Passed API smoke" \
+    CRM_RESULT="Passed contact/company API smoke" \
+    SEARCH_RESULT="Passed search API smoke" \
+    WIDGET_RESULT="Passed API smoke" \
+    CSAT_RESULT="Passed public show API smoke" \
+    ENTERPRISE_RESULT="Pending B12.3 browser/API smoke" \
+    write_report "API smoke passed for GoChat frontend core paths; live browser smoke not run in this mode." "Command run: \`scripts/parity_frontend_smoke.sh --api-smoke\`. Logs and payload captures are under \`$LOG_DIR\`. Browser navigation assertions cover the GoChat Vite app; enterprise screen assertions run in enterprise modes."
   echo "api smoke passed; report written to $REPORT_PATH"
 }
 
 run_browser_smoke() {
   run_api_smoke
-  wait_url "http://$FRONTEND_HOST:$FRONTEND_PORT/app/javascript/entrypoints/dashboard.js" "Chatwoot Vite"
+  wait_url "http://$FRONTEND_HOST:$FRONTEND_PORT/app/javascript/entrypoints/dashboard.js" "GoChat Vite"
   GOCHAT_ROOT="$ROOT" \
-  CHATWOOT_DIR="$CHATWOOT_DIR" \
-  GOCHAT_SMOKE_LOG_DIR="$LOG_DIR" \
-  GOCHAT_SMOKE_API_HOST="$API_HOST" \
-  GOCHAT_SMOKE_API_PORT="$API_PORT" \
-  GOCHAT_SMOKE_FRONTEND_HOST="$FRONTEND_HOST" \
-  GOCHAT_SMOKE_FRONTEND_PORT="$FRONTEND_PORT" \
-  node --experimental-websocket "$ROOT/scripts/parity_frontend_browser_smoke.mjs"
+    CHATWOOT_DIR="$CHATWOOT_DIR" \
+    GOCHAT_SMOKE_LOG_DIR="$LOG_DIR" \
+    GOCHAT_SMOKE_API_HOST="$API_HOST" \
+    GOCHAT_SMOKE_API_PORT="$API_PORT" \
+    GOCHAT_SMOKE_FRONTEND_HOST="$FRONTEND_HOST" \
+    GOCHAT_SMOKE_FRONTEND_PORT="$FRONTEND_PORT" \
+    node --experimental-websocket "$ROOT/scripts/parity_frontend_browser_smoke.mjs"
   BOOT_BACKEND_RESULT="Passed /health during browser smoke" \
-  BOOT_FRONTEND_RESULT="Passed Vite readiness during browser smoke" \
-  AUTH_PROFILE_RESULT="Passed browser login plus API smoke" \
-  INBOX_RESULT="Passed API smoke" \
-  CONVERSATION_RESULT="Passed dashboard browser request plus API smoke" \
-  CRM_RESULT="Passed contact/company API smoke" \
-  SEARCH_RESULT="Passed search API smoke" \
-  WIDGET_RESULT="Passed API smoke" \
-  CSAT_RESULT="Passed public show API smoke" \
-  ENTERPRISE_RESULT="Pending B12.3 browser/API smoke" \
-  write_report "Browser smoke passed for reused Chatwoot login, dashboard boot, and widget boot; API smoke passed for core frontend paths." "Command run: \`scripts/parity_frontend_smoke.sh --browser-smoke\`. Browser report: \`$LOG_DIR/browser-smoke-report.json\`. B12.3 must add enterprise screen assertions."
+    BOOT_FRONTEND_RESULT="Passed Vite readiness during browser smoke" \
+    AUTH_PROFILE_RESULT="Passed browser login plus API smoke" \
+    INBOX_RESULT="Passed API smoke" \
+    CONVERSATION_RESULT="Passed dashboard browser request plus API smoke" \
+    CRM_RESULT="Passed contact/company API smoke" \
+    SEARCH_RESULT="Passed search API smoke" \
+    WIDGET_RESULT="Passed API smoke" \
+    CSAT_RESULT="Passed public show API smoke" \
+    ENTERPRISE_RESULT="Pending B12.3 browser/API smoke" \
+    write_report "Browser smoke passed for GoChat login, dashboard, Billing matrix, and widget boot; API smoke passed for core frontend paths." "Command run: \`scripts/parity_frontend_smoke.sh --browser-smoke\`. Browser report: \`$LOG_DIR/browser-smoke-report.json\`."
   echo "browser smoke passed; report written to $REPORT_PATH"
 }
 
@@ -713,15 +733,15 @@ run_enterprise_api_smoke() {
   json_assert "$body" 'data.payload && data.payload.length >= 1 && data.payload[0].copilot_thread' "Copilot thread messages return nested payload"
 
   BOOT_BACKEND_RESULT="Passed /health during enterprise smoke" \
-  AUTH_PROFILE_RESULT="Passed API smoke" \
-  INBOX_RESULT="Passed API smoke" \
-  CONVERSATION_RESULT="Passed API smoke" \
-  CRM_RESULT="Passed contact/company API smoke" \
-  SEARCH_RESULT="Passed search API smoke" \
-  WIDGET_RESULT="Passed widget browser boot plus API smoke" \
-  CSAT_RESULT="Passed public/account/download enterprise smoke" \
-  ENTERPRISE_RESULT="Passed enterprise API smoke for SLA, CSAT, automation, macros, audit, custom roles, capacity, Captain, and Copilot" \
-  write_report "Enterprise API smoke passed for reused Chatwoot enterprise paths; live enterprise browser navigation remains optional." "Command run: \`scripts/parity_frontend_smoke.sh --enterprise-smoke\`. Logs and payload captures are under \`$LOG_DIR\`. Next B12.3 browser work should load the enterprise screens through the reused Vite app."
+    AUTH_PROFILE_RESULT="Passed API smoke" \
+    INBOX_RESULT="Passed API smoke" \
+    CONVERSATION_RESULT="Passed API smoke" \
+    CRM_RESULT="Passed contact/company API smoke" \
+    SEARCH_RESULT="Passed search API smoke" \
+    WIDGET_RESULT="Passed widget browser boot plus API smoke" \
+    CSAT_RESULT="Passed public/account/download enterprise smoke" \
+    ENTERPRISE_RESULT="Passed enterprise API smoke for SLA, CSAT, automation, macros, audit, custom roles, capacity, Captain, and Copilot" \
+    write_report "Enterprise API smoke passed for GoChat enterprise paths; live enterprise browser navigation remains optional." "Command run: \`scripts/parity_frontend_smoke.sh --enterprise-smoke\`. Logs and payload captures are under \`$LOG_DIR\`."
   echo "enterprise smoke passed; report written to $REPORT_PATH"
 }
 
@@ -729,24 +749,24 @@ run_enterprise_browser_smoke() {
   run_enterprise_api_smoke
   wait_url "http://$FRONTEND_HOST:$FRONTEND_PORT/vite-dev/entrypoints/dashboard.js" "Chatwoot Vite"
   GOCHAT_ROOT="$ROOT" \
-  CHATWOOT_DIR="$CHATWOOT_DIR" \
-  GOCHAT_SMOKE_LOG_DIR="$LOG_DIR" \
-  GOCHAT_SMOKE_API_HOST="$API_HOST" \
-  GOCHAT_SMOKE_API_PORT="$API_PORT" \
-  GOCHAT_SMOKE_FRONTEND_HOST="$FRONTEND_HOST" \
-  GOCHAT_SMOKE_FRONTEND_PORT="$FRONTEND_PORT" \
-  node "$ROOT/scripts/parity_frontend_browser_smoke.mjs" --enterprise
+    CHATWOOT_DIR="$CHATWOOT_DIR" \
+    GOCHAT_SMOKE_LOG_DIR="$LOG_DIR" \
+    GOCHAT_SMOKE_API_HOST="$API_HOST" \
+    GOCHAT_SMOKE_API_PORT="$API_PORT" \
+    GOCHAT_SMOKE_FRONTEND_HOST="$FRONTEND_HOST" \
+    GOCHAT_SMOKE_FRONTEND_PORT="$FRONTEND_PORT" \
+    node "$ROOT/scripts/parity_frontend_browser_smoke.mjs" --enterprise
   BOOT_BACKEND_RESULT="Passed /health during enterprise browser smoke" \
-  BOOT_FRONTEND_RESULT="Passed Vite readiness during enterprise browser smoke" \
-  AUTH_PROFILE_RESULT="Passed browser login plus API smoke" \
-  INBOX_RESULT="Passed API smoke" \
-  CONVERSATION_RESULT="Passed dashboard browser request plus API smoke" \
-  CRM_RESULT="Passed contact/company API smoke" \
-  SEARCH_RESULT="Passed search API smoke" \
-  WIDGET_RESULT="Passed API smoke" \
-  CSAT_RESULT="Passed CSAT API/download and browser route requests" \
-  ENTERPRISE_RESULT="Passed enterprise browser route requests for SLA, CSAT, automation, macros, audit, custom roles, capacity, Captain, and Copilot" \
-  write_report "Enterprise browser smoke passed for reused Chatwoot enterprise route requests and widget boot; enterprise API smoke passed." "Command run: \`scripts/parity_frontend_smoke.sh --enterprise-browser-smoke\`. Browser report: \`$LOG_DIR/browser-smoke-report.json\`."
+    BOOT_FRONTEND_RESULT="Passed Vite readiness during enterprise browser smoke" \
+    AUTH_PROFILE_RESULT="Passed browser login plus API smoke" \
+    INBOX_RESULT="Passed API smoke" \
+    CONVERSATION_RESULT="Passed dashboard browser request plus API smoke" \
+    CRM_RESULT="Passed contact/company API smoke" \
+    SEARCH_RESULT="Passed search API smoke" \
+    WIDGET_RESULT="Passed API smoke" \
+    CSAT_RESULT="Passed CSAT API/download and browser route requests" \
+    ENTERPRISE_RESULT="Passed enterprise browser route requests for SLA, CSAT, automation, macros, audit, custom roles, capacity, Captain, and Copilot" \
+    write_report "Enterprise browser smoke passed for GoChat enterprise route requests and widget boot; enterprise API smoke passed." "Command run: \`scripts/parity_frontend_smoke.sh --enterprise-browser-smoke\`. Browser report: \`$LOG_DIR/browser-smoke-report.json\`."
   echo "enterprise browser smoke passed; report written to $REPORT_PATH"
 }
 
@@ -791,13 +811,13 @@ echo "starting GoChat backend..."
 (cd "$ROOT" && "${backend_cmd[@]}") >"$LOG_DIR/gochat.log" 2>&1 &
 wait_url "http://$API_HOST:$API_PORT/health" "GoChat"
 
-echo "starting reused Chatwoot frontend..."
+echo "starting GoChat frontend..."
 (cd "$CHATWOOT_DIR" && "${frontend_cmd[@]}") >"$LOG_DIR/chatwoot-vite.log" 2>&1 &
-wait_url "http://$FRONTEND_HOST:$FRONTEND_PORT/app/javascript/entrypoints/dashboard.js" "Chatwoot Vite"
+wait_url "http://$FRONTEND_HOST:$FRONTEND_PORT/app/javascript/entrypoints/dashboard.js" "GoChat Vite"
 
 BOOT_BACKEND_RESULT="Passed boot readiness" \
-BOOT_FRONTEND_RESULT="Passed boot readiness" \
-write_report "Boot smoke passed for backend and reused Chatwoot frontend." "This run verified process boot and HTTP readiness only. B12.2 must add browser/API path assertions and update the smoke matrix."
+  BOOT_FRONTEND_RESULT="Passed boot readiness" \
+  write_report "Boot smoke passed for backend and GoChat frontend." "This run verified process boot and HTTP readiness only. Browser/API path assertions run in --browser-smoke."
 echo "smoke boot passed; report written to $REPORT_PATH"
 
 if [[ "$KEEP_ALIVE" == "true" ]]; then
diff --git a/backend/tests/e2e/rbac_e2e_test.go b/backend/tests/e2e/rbac_e2e_test.go
index 72cb6de8..0040d83e 100644
--- a/backend/tests/e2e/rbac_e2e_test.go
+++ b/backend/tests/e2e/rbac_e2e_test.go
@@ -135,7 +135,7 @@ func (s *RBACE2ETestSuite) TestPermissionCheckForRole() {
 	assert.True(s.T(), agentCtx.Can("create", "message"))
 }
 
-// TestCustomRolePermissions verifies custom role permission matrix.
+// TestCustomRolePermissions verifies binary custom-role permissions.
 func (s *RBACE2ETestSuite) TestCustomRolePermissions() {
 	customRole := &model.CustomRole{
 		AccountID:   s.account.ID,
@@ -152,7 +152,7 @@ func (s *RBACE2ETestSuite) TestCustomRolePermissions() {
 		s.T().Log("CustomRole.GetPermissionMap not implemented yet")
 		return
 	}
-	assert.Equal(s.T(), model.PermissionLevelRead, perms[model.DimensionConversationManage])
+	assert.Equal(s.T(), model.PermissionLevelFull, perms[model.DimensionConversationManage])
 	assert.Equal(s.T(), model.PermissionLevelNone, perms[model.DimensionConversationDelete])
 }
 
diff --git a/docs/plans/2026-07-31-shangwutong-connector-development-plan.md b/docs/plans/2026-07-31-shangwutong-connector-development-plan.md
index 3816075e..b206d96e 100644
--- a/docs/plans/2026-07-31-shangwutong-connector-development-plan.md
+++ b/docs/plans/2026-07-31-shangwutong-connector-development-plan.md
@@ -2,6 +2,7 @@
 
 > 日期：2026-07-31
 > 状态：功能实现与自动化验证已完成，待真实账号灰度验证
+> 能力缺口修复计划：[`2026-09-12-shangwutong-capability-gap-repair-plan.md`](2026-09-12-shangwutong-capability-gap-repair-plan.md)
 > 实现目录：`channels/shangwutong/`
 > 协议依据：`reference/shang-wu-tong/src/` 与 `reference/shang-wu-tong/docs/`
 > GoChat 接入方式：独立 Connector + 商务通 Inbox（复用并扩展 API Inbox 能力）
@@ -27,7 +28,7 @@
 ### 1.2 已确认的架构决策
 
 | 决策项 | 选择 |
-|---|---|
+| --- | --- |
 | 商务通账号关系 | 独立站点账号 |
 | 账号与 GoChat 映射 | 一个商务通账号对应一个商务通 Inbox |
 | Connector 进程模型 | 一个 GoChat 部署对应一个 Connector 服务，统一管理全部商务通 Inbox |
@@ -223,7 +224,7 @@ channels/shangwutong/
 依赖和工具版本首版固定如下，升级必须单独提交并跑完整 contract/规模测试：
 
 | 依赖/工具 | 固定版本 | 用途 |
-|---|---:|---|
+| --- | ---: | --- |
 | Go toolchain | `1.26.x` | Connector 编译、测试和 sqlc 生成 |
 | `github.com/spf13/cobra` | `v1.10.2` | CLI 与运维命令 |
 | `github.com/gofiber/fiber/v3` | `v3.4.0` | GoChat webhook、health/ready/metrics |
@@ -286,7 +287,7 @@ go vet ./...
 ### 5.1 Connector 环境变量
 
 | 变量 | 必填 | 默认值 | 说明 |
-|---|---:|---|---|
+| --- | ---: | --- | --- |
 | `SWT_CONNECTOR_LISTEN` | 否 | `:9100` | webhook、health、ready、metrics 监听地址 |
 | `SWT_CONNECTOR_DB_PATH` | 是 | — | SQLite 路径，如 `/data/connector.db` |
 | `GOCHAT_BASE_URL` | 是 | — | GoChat 内部地址 |
@@ -789,7 +790,7 @@ Connector 启动先用 SQLite 中最后一次成功配置启动已有 supervisor
 GoChat 的 `desired_presence` 是期望值；空心跳或仅有 `r=ok` 只能确认连接/session 状态，`actual_presence` 取最近一次成功的 login/status/logout，或协议明确返回的 kind=11 在线状态事件：
 
 | GoChat 值 | 登录 `t0` | 在线切换端点 |
-|---|---:|---|
+| --- | ---: | --- |
 | `online` | `3` | `oc/online.aspx` |
 | `busy` | `2` | `oc/busy.aspx` |
 | `away` | `1` | `oc/away.aspx` |
@@ -906,7 +907,7 @@ typing state change
 ### 8.4 心跳错误分类
 
 | 错误 | 状态与动作 |
-|---|---|
+| --- | --- |
 | `r=ok` | 重置网络失败计数，解析并持久化事件 |
 | `tickint reset` | `relogin_required`，立即按 desired presence 登录 |
 | `server connect err` | `degraded`，带 jitter 重试，不立即反复登录 |
@@ -996,7 +997,7 @@ RefuseWaitingVisitor
 ### 9.5 消息和会话操作
 
 | 功能 | 端点/方式 |
-|---|---|
+| --- | --- |
 | 文本/表情 | `oc/send.aspx`，HTML 内容 |
 | 图片 | `oc/sendmorepics.aspx` multipart |
 | 文件 | `oc/sendfile.aspx` multipart |
@@ -1030,7 +1031,7 @@ RefuseWaitingVisitor
 Connector 不持有 SuperAdmin 凭据，不调用 Connector 账号创建接口，也不维护独立账号后台。`Channel::Shangwutong` 是专用 Inbox 类型，但下列消息能力直接复用和扩展 API Inbox：
 
 | 能力 | 当前 GoChat 事实 | 本项目要求 |
-|---|---|---|
+| --- | --- | --- |
 | Public contact/conversation | 已支持创建、查询、更新 | 直接复用 |
 | Public message | 只创建 `incoming/text`，附件依赖 staged upload | 不作为 v1 canonical import；所有商务通消息统一走 Application API，Public 路径仅保留兼容测试 |
 | Application message | 已支持 incoming/outgoing/activity、content type 和 multipart 附件，Message model 已有 `external_source_ids` | 增加受限 `external`、`additional_attributes`、`external_source_ids` 输入和幂等键；`external=true` 时禁止触发渠道外发 worker |
@@ -1050,14 +1051,14 @@ GoChat 消息等待外部发送结果时统一使用现有前端已识别的 `st
 ### 10.2 交互方向、端点与鉴权总表
 
 | 方向 | 目的 | 方法与端点 | 鉴权 | 重试级别 |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | Connector → GoChat | 启动全量配置 reconcile | `GET /api/v1/connector/shangwutong/inboxes` | Connector service token | 分页幂等重试 |
 | Connector → GoChat | 拉取单 Inbox 配置 | `GET /api/v1/connector/shangwutong/inboxes/{inbox_id}` | Connector service token | 幂等重试 |
 | Connector → GoChat | 回写心跳/连接/凭据状态 | `PUT /api/v1/connector/shangwutong/inboxes/{inbox_id}/status` | Connector service token | 最新状态覆盖重试 |
 | Connector → GoChat | 回写坐席消息真实发送结果 | `PUT /api/v1/connector/shangwutong/inboxes/{inbox_id}/messages/{message_id}/status` | Connector service token | 幂等重试直到 synced |
 | Connector → GoChat | upsert Contact | `POST /public/api/v1/inboxes/{inbox_identifier}/contacts` | body 内 identifier HMAC | 幂等重试 |
 | Connector → GoChat | 更新 Contact | `PATCH /public/api/v1/inboxes/{inbox_identifier}/contacts/{swt_sid}` | body 内 identifier HMAC | 幂等重试 |
-| Connector → GoChat | 查询/创建 Conversation | `GET|POST /public/api/v1/inboxes/{inbox_identifier}/contacts/{swt_sid}/conversations` | Contact source ID；HMAC 已在 contact 创建时验证 | 幂等 ensure |
+| Connector → GoChat | 查询/创建 Conversation | `GET | POST /public/api/v1/inboxes/{inbox_identifier}/contacts/{swt_sid}/conversations` | Contact source ID；HMAC 已在 contact 创建时验证 | 幂等 ensure |
 | Connector → GoChat | 导入消息/附件/activity | `POST /api/v1/accounts/{gochat_account_id}/conversations/{gochat_conversation_id}/messages` | Connector service token | 幂等重试 |
 | Connector → GoChat | 更新会话属性 | `POST /api/v1/accounts/{gochat_account_id}/conversations/{gochat_conversation_id}/custom_attributes` | Connector service token | 幂等重试 |
 | Connector → GoChat | 显式切换会话状态 | `POST /api/v1/accounts/{gochat_account_id}/conversations/{gochat_conversation_id}/toggle_status` | Connector service token | 幂等重试 |
@@ -1081,7 +1082,7 @@ GoChat 当前也接受 `access-token` 头中的用户 JWT，但 Connector 固定
 ### 10.3 标识符、时间与幂等规范
 
 | 字段 | 含义 | 格式/来源 |
-|---|---|---|
+| --- | --- | --- |
 | `connector_account_id` | Connector SQLite 运行记录主键 | 整数，只作本地外键，不用于跨系统识别账号 |
 | `gochat_account_id` | GoChat tenant/account ID | `accounts.gochat_account_id` |
 | `gochat_inbox_id` | 商务通 Inbox 数字 ID | Connector 账号存在性和 upsert 的唯一跨系统键 |
@@ -1633,7 +1634,7 @@ typing 采用短超时同步投递，Connector 只更新该账号 supervisor 的
 ### 10.7 状态码、重试与失败语义
 
 | HTTP 状态 | 语义 | 调用方动作 |
-|---:|---|---|
+| ---: | --- | --- |
 | 200 | 成功或幂等重放 | 完成 |
 | 202 | webhook/异步命令已可靠入库 | 完成，后续查状态 |
 | 400 | JSON/字段错误 | 永久失败，人工或代码修复 |
@@ -1655,7 +1656,7 @@ typing 采用短超时同步投递，Connector 只更新该账号 supervisor 的
 ### 10.8 GoChat 展示能力基线
 
 | GoChat 场景 | 当前展示能力 | 商务通使用方式 |
-|---|---|---|
+| --- | --- | --- |
 | 普通文本/换行/链接 | 原生 text bubble | 直接映射，先清洗 HTML |
 | 图片/音频/视频/文件 | 原生 attachment bubble | 上传为 attachment；语音设置 `is_voice_message` |
 | 居中系统事件 | 原生 activity bubble | 状态、分配、转接、邀请等受控文案 |
@@ -1672,7 +1673,7 @@ typing 采用短超时同步投递，Connector 只更新该账号 supervisor 的
 分类：`E`=原生近似无损；`L`=可展示但有语义损失；`A`=只更新属性/状态；`R`=只保留原始事件；`X`=需要 GoChat 扩展。一个事件可以同时采用多种策略。
 
 | kind | 商务通含义 | GoChat 映射 | 分类 | 处理细节 |
-|---:|---|---|---|---|
+| ---: | --- | --- | --- | --- |
 | -8 | 首次响应统计 | Connector metric + raw；未来 reporting event ingest | R/X | 不生成聊天气泡，解析 `chat_firstresponsetime` 和 operator |
 | -7 | 内部跳过 | raw + ignored | R | 推进 mid，不展示 |
 | -5 | 客服撤回 | DELETE 已映射 outgoing message | E/R | `text` 是目标 `swt_message_id`；无目标映射时 `unmapped_retraction` |
@@ -1715,7 +1716,7 @@ kind=11 的 `text=0/1/2/3` 分别更新 Connector `actual_presence=offline/away/
 #### 10.9.1 kind=0 状态子表
 
 | text | 商务通状态 | GoChat status | 额外展示/属性 |
-|---:|---|---|---|
+| ---: | --- | --- | --- |
 | 0 | 新访客 | 不主动创建会话或保持现状 | Contact ensure，`swt_state=new_visitor` |
 | 1 | 邀请中 | 不改 status | activity“已发起邀请”，`swt_state=inviting` |
 | 3 | 等待应答 | `open` | activity“访客等待接待”，记录 waiting_since |
@@ -1730,20 +1731,20 @@ GoChat `pending` 不代表商务通“等待应答”，因此不做该映射。
 ### 10.10 kind=2/3/67 消息内容映射
 
 | 商务通内容 | GoChat 展示 | 分类 | 解析与降级 |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | 纯文本 | text bubble | E | URL decode + HTML entity decode，保留换行 |
 | `<P>/<BR>` HTML | text bubble | L | 白名单转 Markdown/纯文本；脚本、style、事件属性全部移除 |
 | HTML 内 `<img>` | image attachment + caption | E/L | 多图支持；无法下载时用 alt/URL fallback |
 | HTML 表情图片 | emoji/小 image 或 Unicode 文本 | L | 有已知表情字典则转 Unicode，否则保留 alt 文本 |
-| `voice_msg|source|url` | audio attachment | E | 校验来源与 MIME，设置 voice metadata |
-| `filemsg|...` | file attachment | E/L | 保留文件名、大小、MIME；字段缺失时 fallback link |
-| `baidunmdata_msg|1|url` | 商品卡片 | L/X | 首版 text 摘要 + link；需 `swt_rich_card` 才能无损 |
-| `baidunmdata_msg|3|url` | 案例卡片 | L/X | 同上 |
-| `baidunmdata_msg|other|url` | 优惠券卡片 | L/X | 同上 |
+| `voice_msg | source | url` | audio attachment | E | 校验来源与 MIME，设置 voice metadata |
+| `filemsg | ...` | file attachment | E/L | 保留文件名、大小、MIME；字段缺失时 fallback link |
+| `baidunmdata_msg | 1 | url` | 商品卡片 | L/X | 首版 text 摘要 + link；需 `swt_rich_card` 才能无损 |
+| `baidunmdata_msg | 3 | url` | 案例卡片 | L/X | 同上 |
+| `baidunmdata_msg | other | url` | 优惠券卡片 | L/X | 同上 |
 | 微信/企业微信 JSON `text` | text bubble | E | 保留渠道名在 content attributes |
 | 微信/企业微信 JSON `voice` | audio attachment | E/L | 下载地址/token 失效时 fallback text |
 | 微信/企业微信 JSON `image` | image attachment | E/L | 同上 |
-| `0|好友进入对话窗口` | activity | E | 不当作访客发言 |
+| `0 | 好友进入对话窗口` | activity | E | 不当作访客发言 |
 | 字节跳动咨询签名 URL | text/link 或 image attachment | L/R | 需真实样本确认签名资源类型与有效期 |
 | 可识别 location JSON | location attachment | X/L | 后端 metadata serializer 补齐后原生展示；之前转文本地址 |
 | 可识别 contact JSON | contact attachment | X/L | 后端 metadata serializer 补齐后原生展示；之前转姓名/电话文本 |
@@ -1752,7 +1753,7 @@ GoChat `pending` 不代表商务通“等待应答”，因此不做该映射。
 出站 GoChat → 商务通能力矩阵：
 
 | GoChat 内容 | 商务通发送 | 策略 |
-|---|---|---|
+| --- | --- | --- |
 | text | `oc/send.aspx` | 原生支持 |
 | image attachment | `oc/sendmorepics.aspx` | 原生支持；逐项发送并保序 |
 | file attachment | `oc/sendfile.aspx` | 原生支持 |
@@ -1765,48 +1766,48 @@ GoChat `pending` 不代表商务通“等待应答”，因此不做该映射。
 ### 10.11 kind=31 系统消息子类型映射
 
 | 子类型 | GoChat 映射 | 分类 | 备注 |
-|---|---|---|---|
-| `distribute_chat|name` | activity + `swt_assignee_name` | E/A | 首版不调用 assign API；未来明确配置 operator→agent 映射后才允许分配 |
-| `distribute_lastoname|name` | attribute | A | 默认不生成气泡 |
-| `guest_direct_chat|name` | activity + assignee attribute | E/A | 不自动创建同名 GoChat agent |
+| --- | --- | --- | --- |
+| `distribute_chat | name` | activity + `swt_assignee_name` | E/A | 首版不调用 assign API；未来明确配置 operator→agent 映射后才允许分配 |
+| `distribute_lastoname | name` | attribute | A | 默认不生成气泡 |
+| `guest_direct_chat | name` | activity + assignee attribute | E/A | 不自动创建同名 GoChat agent |
 | `guest_open_chat` | status=open + activity | E | ensure conversation |
 | `guest_continue_chat` | status=open + activity | E | 已 resolved 时 reopen |
 | `cdcheck_chat_ended` | status=resolved + activity | E | 明确结束信号 |
 | `away_timeout_chat` | activity；可配置 resolve | L | 默认等待真实业务确认 |
 | `robot_chat` | `swt_robot_state=active` + activity | A/L/X | 无 GoChat 等价控制状态 |
-| `robot_chat_fenpei|...` | robot/assignee attributes + activity | A/L | 字段按真实样本解析 |
-| `invite0|name` | invitation activity | L/X | 快速邀请；无访客侧动作 UI |
-| `invite1|name` | invitation activity | L/X | 强制对话 |
-| `invite2|...` | invitation activity + raw | L/R/X | 自定义邀请正文需清洗 |
-| `invite3|name` | invitation activity | L/X | 请求直接对话 |
-| `inviteyuyue|name` | invitation activity | L/X | GoChat form 不能代表商务通原预约单 |
-| `invitepingjia|name` | invitation activity | L/X | 不映射成 GoChat CSAT，避免评价回错系统 |
-| `guest_refuse_invite|...` | activity | E/L | 保留拒绝原因文本 |
-| `distribute1_chat|...` | raw + 可选 activity | R/L | 对话列表结构需真实包确认 |
-| `lastoname_is|...` | assignee attribute | A | 不展示内部标识 |
-| `ACT_CL|wx_{id}` | Contact `swt_wechat_id` + activity | E/A | 属于敏感字段，受权限控制 |
-| `ACT_CL|num_{phone}` | 校验后更新 phone + activity | E/A | 不合法号码只保存 raw |
-| `ACT_CL|{dial}` | activity | L | 仅表示进入拨号，不等于呼叫成功 |
-| `ACT_XST|RobotAutoMsg|text` | external outgoing | E | senderName=商务通机器人 |
-| `ACT_XST|SWTSettingAutoMsg|text` | external outgoing | E | senderName=商务通自动回复 |
-| `ACT_XST|SystemAutoMsg|text` | external outgoing/activity | E/L | 有明确对话内容用 outgoing，否则 activity |
-| `ACT_XST|BaiduAutoMsg|text` | external outgoing | E | 去掉稳定前缀但保留来源属性 |
-| `ACT_XST|<human-readable notice>` | activity | L | 仅白名单可见文本 |
-| `ACT_XST|NotShow|QuDaoVisitorInfo|...` | attributes + raw，不建气泡 | A/R | 与名称语义一致，避免污染会话 |
-| `ACT_XST|NotShow|QuDaoInfoWhenReceiveVisitorMsg|json` | attributes + raw | A/R | 展开 SWTID/SWTCID/QueryWord 等已知键 |
-| `ACT_XST|NotShow|BaiduRobotReleasedNoticeMsg|...` | robot state + raw | A/R | 不展示内部控制消息 |
-| `ACT_XST|NotShow|BaiduRobotRecvKFMsgState|...` | outbound delivery hint + raw | A/R | 可用于对账，不能当新消息 |
-| `ACT_XST|NotShow|SWTRobotChatWindowNotice|...` | robot state + raw | A/R | 需样本确认字段 |
-| `ACT_XST|NotShow|BaiduLingYinCallBackUrlInfoMsg|...` | raw；可提取受控 callback link | R/X | 链接权限/有效期未确认 |
-| `ACT_XST|ByteDanceLeaveMsg|...` | 解析成功则 incoming，否则 activity+raw | L/R/X | 需真实包确认留言正文、访客 ID、媒体结构 |
-| `ACT_XST|ByteDanceSysMsg|...` | activity + raw | L/R | 不可见控制字段不展示 |
-| `ACT_XST|ByteDanceCSFenPeiMsg|...` | assignee attribute + activity | L/A | 不自动匹配 agent |
+| `robot_chat_fenpei | ...` | robot/assignee attributes + activity | A/L | 字段按真实样本解析 |
+| `invite0 | name` | invitation activity | L/X | 快速邀请；无访客侧动作 UI |
+| `invite1 | name` | invitation activity | L/X | 强制对话 |
+| `invite2 | ...` | invitation activity + raw | L/R/X | 自定义邀请正文需清洗 |
+| `invite3 | name` | invitation activity | L/X | 请求直接对话 |
+| `inviteyuyue | name` | invitation activity | L/X | GoChat form 不能代表商务通原预约单 |
+| `invitepingjia | name` | invitation activity | L/X | 不映射成 GoChat CSAT，避免评价回错系统 |
+| `guest_refuse_invite | ...` | activity | E/L | 保留拒绝原因文本 |
+| `distribute1_chat | ...` | raw + 可选 activity | R/L | 对话列表结构需真实包确认 |
+| `lastoname_is | ...` | assignee attribute | A | 不展示内部标识 |
+| `ACT_CL | wx_{id}` | Contact `swt_wechat_id` + activity | E/A | 属于敏感字段，受权限控制 |
+| `ACT_CL | num_{phone}` | 校验后更新 phone + activity | E/A | 不合法号码只保存 raw |
+| `ACT_CL | {dial}` | activity | L | 仅表示进入拨号，不等于呼叫成功 |
+| `ACT_XST | RobotAutoMsg | text` | external outgoing | E | senderName=商务通机器人 |
+| `ACT_XST | SWTSettingAutoMsg | text` | external outgoing | E | senderName=商务通自动回复 |
+| `ACT_XST | SystemAutoMsg | text` | external outgoing/activity | E/L | 有明确对话内容用 outgoing，否则 activity |
+| `ACT_XST | BaiduAutoMsg | text` | external outgoing | E | 去掉稳定前缀但保留来源属性 |
+| `ACT_XST | <human-readable notice>` | activity | L | 仅白名单可见文本 |
+| `ACT_XST | NotShow | QuDaoVisitorInfo | ...` | attributes + raw，不建气泡 | A/R | 与名称语义一致，避免污染会话 |
+| `ACT_XST | NotShow | QuDaoInfoWhenReceiveVisitorMsg | json` | attributes + raw | A/R | 展开 SWTID/SWTCID/QueryWord 等已知键 |
+| `ACT_XST | NotShow | BaiduRobotReleasedNoticeMsg | ...` | robot state + raw | A/R | 不展示内部控制消息 |
+| `ACT_XST | NotShow | BaiduRobotRecvKFMsgState | ...` | outbound delivery hint + raw | A/R | 可用于对账，不能当新消息 |
+| `ACT_XST | NotShow | SWTRobotChatWindowNotice | ...` | robot state + raw | A/R | 需样本确认字段 |
+| `ACT_XST | NotShow | BaiduLingYinCallBackUrlInfoMsg | ...` | raw；可提取受控 callback link | R/X | 链接权限/有效期未确认 |
+| `ACT_XST | ByteDanceLeaveMsg | ...` | 解析成功则 incoming，否则 activity+raw | L/R/X | 需真实包确认留言正文、访客 ID、媒体结构 |
+| `ACT_XST | ByteDanceSysMsg | ...` | activity + raw | L/R | 不可见控制字段不展示 |
+| `ACT_XST | ByteDanceCSFenPeiMsg | ...` | assignee attribute + activity | L/A | 不自动匹配 agent |
 | 其他 `ACT_XST` | 白名单文本 activity，否则 raw | L/R | 未知结构不能直接渲染 HTML |
 
 ### 10.12 无法直接映射的类型与解决评估
 
 | 类型/场景 | 无法直接映射原因 | 首版降级 | 推荐解决方案 | 决策/优先级 |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | 商品/案例/优惠券卡片 | GoChat 没有商务通卡片字段和稳定 bubble contract | text 摘要 + 原链接 | 新增通用 `external_rich_card` content type、JSON Schema 和前端 bubble | P1，样本齐全后做 |
 | 邀请/预约/评价动作 | GoChat conversation status/form/CSAT 会触发不同业务，不等价 | activity + attributes | 若需要在 GoChat 操作商务通邀请，增加 Connector command API 与专用 action component | P2，不阻塞收发消息 |
 | 等待/内部转接/转接中 | GoChat 只有 open/pending/resolved/snoozed，语义粒度不足 | status=open + `swt_state` + activity | 增加 channel-neutral `external_state` 展示 badge，不扩展核心 status enum | P1 |
diff --git a/docs/plans/2026-09-11-shangwutong-classification-sync-plan.md b/docs/plans/2026-09-11-shangwutong-classification-sync-plan.md
index ca5110df..5a12e423 100644
--- a/docs/plans/2026-09-11-shangwutong-classification-sync-plan.md
+++ b/docs/plans/2026-09-11-shangwutong-classification-sync-plan.md
@@ -2,6 +2,7 @@
 
 > 日期：2026-09-11
 > 状态：首版实现完成，待真实商务通账号灰度验证
+> 后续能力缺口修复：[`2026-09-12-shangwutong-capability-gap-repair-plan.md`](2026-09-12-shangwutong-capability-gap-repair-plan.md)
 > 关联调研：[`docs/research/2026-09-11-shangwutong-pc-classification-protocol.md`](../research/2026-09-11-shangwutong-pc-classification-protocol.md)
 
 ## 1. 目标与边界
diff --git a/docs/plans/2026-09-12-custom-role-installation-gating-review-plan.md b/docs/plans/2026-09-12-custom-role-installation-gating-review-plan.md
new file mode 100644
index 00000000..502422c6
--- /dev/null
+++ b/docs/plans/2026-09-12-custom-role-installation-gating-review-plan.md
@@ -0,0 +1,245 @@
+# 自定义角色与安装类型清理：评审及修复计划
+
+- 日期：2026-09-12
+- 基线：`main` / `6e62f509`，以及评审开始时的未提交改动。
+- 范围：角色 API、Store、Modal、客服角色编辑、权限归一化、路由与侧边栏策略、浏览器 Smoke。
+- 本文状态：两路独立只读评审及父审复核完成；R1–R11 的最小修复已实施并完成定向静态/单元验证，**仍未证明真实浏览器、PostgreSQL 端到端通过**。
+- 不涉及：工作区内并行进行的商悟通相关改动。不要据此批量回滚整个工作区。
+
+## 1. 结论：方向正确，但清理边界与验收存在遗漏
+
+**不建议整体回滚；建议保留主体修复，按问题逐项补齐。**
+
+1. 删除 Community/Enterprise 安装版本判断符合 GoChat 的定位，不能为了修复回归重新引入版本体系。
+2. 删除版本判定时顺带删除了 Cloud 专属账单入口的可见性条件，这是明确的新增交互回归。
+3. Store 改为抛出错误是合理的，但未同步更新全部调用方，客服列表留下未处理的 Promise rejection。
+4. 两个 P1 旧缺陷应优先修复：管理员切换自定义角色却仍保留管理员身份；自定义角色 ID 未校验账户归属/有效性，查询失败还回退到可能更宽的默认 Agent 权限。
+5. 本次新增删除文案将“转为默认 Agent”称为“降级”，但某些受限角色反而会获得额外权限，需要修正文案。
+6. 零权限角色、已有会话权限刷新、错误 PATCH envelope、并发删除确认状态仍有遗漏。既有 feature flag 与 Smoke 的测试对象/启动配置也存在不一致。单元测试、构建与 Smoke self-test 通过，不足以证明权限与功能可用性闭环。
+
+本轮没有证据表明“删除 Enterprise 判断直接造成了新的后端越权”。尤其需要注意：**基线 `usePolicy` 的 Enterprise 判断已固定返回 `true`**；多数相关路由删除的是已不生效的判断，Billing 的 Cloud-only 条件才是真实行为变化。不要把所有旧问题误报成本次新增回归。
+
+## 2. 必须保留的设计边界
+
+- 六个二值权限：key 存在即拥有该维度完整权限，不存在即无权限。不引入 `full/read/none` 三态 UI。
+- `GetPermissionMap()` 对有效维度的旧非 `none` 值归一化为 `full`，是已选择的兼容策略；未知维度仍为 `none`。上线前需检查旧 `read` 数据的影响，但不能未经确认改变此约定。
+- 保留账户权限、SuperAdmin 身份校验、业务 feature flag、合法 Cloud 计费/Paywall 边界。
+- `/enterprise/api/v1` 是兼容 API 路径，不等于安装版本限制，不能按字符串批量删除。
+- 不通过“全部启用 feature flag”或移除后端校验来掩盖入口/API 不一致。
+- 保留本次 `{ custom_role: data }` 请求封装、编辑权限数组克隆、列表错误/重试和删除影响提示；但将误导性的“降级”文案按 R11 修正。
+
+## 3. 问题清单及最小修复
+
+优先级：P1＝权限安全或核心流程阻断；P2＝交互回归、一致性与验证缺口。下列静态链路成立，不等于已执行真实用户端到端复现。
+
+| 分类 | 条目 |
+| --- | --- |
+| P1 旧安全缺陷 | R1 管理员降权失败；R6 角色归属/有效性未校验及错误时扩大权限 |
+| 明确新增回归 | R2 非云 Billing；R3 客服页错误漏处理；R11 误导性删除文案 |
+| 既有异步竞争被部分修复显露 | R10 删除请求完成时清理了新的确认状态 |
+| 旧一致性/契约缺陷 | R4 feature flag；R7 零权限；R8 会话权限；R9 envelope |
+| 验证缺口 | R5 Smoke 对象、配置与断言不足 |
+
+### R1 · P1 · 管理员改为自定义角色，可能没有真正降权【旧问题，本次未补齐】
+
+**证据链**
+
+- `frontend/app/javascript/dashboard/routes/dashboard/settings/agents/EditAgent.vue`：选择自定义角色时，只提交 `custom_role_id`，没有同时提交基础 `role: 'agent'`。
+- `backend/internal/repository/agent_repo.go` / `UpdateAgentWithActive`：只有角色非空才更新 `role`；写入自定义角色 ID 不会自动清除管理员身份。
+- `backend/internal/middleware/account_scope.go` / `AccountScopeWithService`：只有 `customRoleID > 0 && role != administrator` 才加载自定义权限；管理员走完整管理权限分支。
+- 上游参考：`docs/chatwoot/enterprise/app/controllers/enterprise/api/v1/accounts/agents_controller.rb`。需结合 GoChat 自己的基础角色与授权语义处理，不能只移植关联字段赋值。
+
+**触发与影响**：把现有管理员切换为权限受限的自定义角色；保存成功并不代表后端降权成功。残留 `administrator + custom_role_id` 组合可继续绕过自定义权限限制。
+
+**最小修复**
+
+1. 前端选择自定义角色时显式提交 `role: 'agent'` 与对应 ID。
+2. 后端服务层统一约束创建/更新状态转换，不能依赖某一个前端调用方；在同一次持久化中原子更新基础角色与关联 ID。显式同时指定 administrator 和自定义角色的矛盾请求应拒绝。
+3. 检查现有非法组合与权限缓存。数据修正前先盘点、确认意图，不直接批量降权所有关联管理员。
+4. 内置角色切换显式清空 `custom_role_id`，继续保留本次已有清空支持。
+
+**验收**：管理员→受限角色后重新读取 profile，并实际调用一个允许、一个禁止的 API；禁止项必须返回 403。覆盖自定义角色→agent/administrator、跨账户 ID 拒绝，以及前端之外的直接 API 更新。
+
+### R2 · P2 · 非云部署出现不可用的 Billing 导航【新增回归】
+
+**证据链**
+
+- `frontend/app/javascript/dashboard/routes/dashboard/settings/billing/billing.routes.js:8-25`：删除 Cloud-only metadata。
+- `frontend/app/javascript/dashboard/components-next/sidebar/provider.js:129-132`：只再检查 permissions / feature flags。
+- `frontend/app/javascript/dashboard/components-next/sidebar/Sidebar.vue:794-799`：无条件定义 Billing 菜单项。
+- `frontend/app/javascript/dashboard/routes/dashboard/settings/billing/Index.vue:79-98,140`：非云部署直接返回首页，并在拉取账单信息前退出。
+- `frontend/app/javascript/shared/store/globalConfig.js:55-57`：只有 `DEPLOYMENT_ENV === 'cloud'` 才认定为云部署；GoChat 默认后端运行配置未提供该值。
+- 上游同时存在 Cloud-only 菜单条件和页面自身 guard，并非两种企业/社区版本判断。
+
+**影响**：普通非云部署管理员看到“账单”，点击后被跳回首页。当前证据不支持“新触发了扣费”或“新绕过后端计费权限”。
+
+**最小修复**：用 Sidebar 已有的 `isOnChatwootCloud` 状态有条件地加入 Billing 菜单项；保留页面直链 guard。不恢复 `INSTALLATION_TYPES`，不移除页面 guard 来迁就菜单。
+
+**验收**：非云普通/定制品牌管理员在展开与折叠菜单均看不到入口；直链仍安全跳转且无 subscription/checkout 请求。Cloud 管理员保持可见；普通 agent 与无管理权限的自定义角色仍不能访问。
+
+### R3 · P2 · 角色列表错误传播未覆盖客服列表调用方【新增回归】
+
+**证据链**
+
+- `frontend/app/javascript/dashboard/store/modules/customRole.js`：`getCustomRole` 失败时现在通过 `throwErrorMessage` 向调用方抛出。
+- `frontend/app/javascript/dashboard/routes/dashboard/settings/agents/Index.vue:53-56`：`onMounted` 仍裸调用 `store.dispatch('customRole/getCustomRole')`，没有 await/catch。
+- 自定义角色 Index 已处理失败；客服列表这一调用点没有同步适配。上游调用方式不能直接作为依据，因为本次本地 Store 的错误契约已经变化。
+
+**影响**：403、500、断网等情况下，角色映射加载失败成为未处理拒绝，页面没有明确的角色数据不可用提示。不要夸大为已证明“整个客服列表必然崩溃”。
+
+**最小修复**：在页面边界捕获失败，保留客服列表的独立加载；明确角色数据加载失败/重试状态。不要把 Store 改回吞错。角色尚未解析时不得静默改写为内置角色或允许提交错误身份。
+
+**验收**：角色请求 403/500/网络失败时，无 unhandled rejection，客服列表仍可显示，角色字段明确降级并可重试；请求成功后角色名称与编辑选择正确恢复。
+
+### R4 · P2 · 普通非云策略忽略 feature flag，入口与实际行为不一致【旧问题】
+
+**证据链**
+
+- `frontend/app/javascript/dashboard/composables/usePolicy.js:47-60`：定制品牌/Cloud 分支检查 flags，普通非云分支无条件返回 `true`；HEAD 已存在此行为。
+- `frontend/app/javascript/dashboard/modules/search/components/SearchHeader.vue:52-60` 可展示高级筛选，但 `SearchView.vue:248-268,277-283,295-300` 在 `advanced_search` 未开启时会剔除对应参数。入口可用但筛选不生效。
+- `frontend/app/javascript/dashboard/routes/dashboard/captain/tools/Index.vue:83-86` 在无 Paywall 时加载；后端 `captain_custom_tool_handler.go` / `captain_custom_tool_service.go` 仍要求 `custom_tools || captain_integration_v2`，两者关闭时返回 403。
+
+**最小修复**：先逐项区分业务可用性与升级入口，再让普通非云策略尊重真实可用性。保留 Cloud premium upsell，保留 Custom Tools 的“任一 flag 可用”等模块特例；直链关闭功能时显示不可用状态，不应仅凭“无 Paywall”就发请求。
+
+**验收**：权限拒绝优先；advanced_search 开关同时控制 UI 和请求参数；Custom Tools 覆盖两个 flag 都关闭/任一开启；Cloud SLA/Custom Role Paywall 与定制品牌行为不退化。
+
+### R5 · P2 · 现有 Smoke 不能证明这次移除版本判断的正确性【原有验证缺口】
+
+**证据链**
+
+1. `backend/scripts/parity_frontend_smoke.sh:7,36,795` 默认使用 `docs/chatwoot`，不是修改后的 `frontend/`；浏览器模式连接既有 Vite 服务，传目录不等于证明服务来源。
+2. `backend/scripts/parity_frontend_browser_smoke.mjs:108-148` 注入 Cloud globals，缺少非云部署用例，无法发现 R2。
+3. 独立 SPA 的 `frontend/app/javascript/entrypoints/dashboardConfig.js:1-40` 从 `window.__GOCHAT_CONFIG__` 重建 globals；旧 Smoke 注入方式会被覆盖。仅把目录改成 `frontend/` 仍不够。
+4. Shell 检查 `/vite-dev/entrypoints/dashboard.js`，独立 SPA 入口却是 `/app/javascript/entrypoints/dashboard.js`。
+5. `--self-test` 只检查请求分类；实际扩展 Smoke 主要检查挂载和请求命中，不覆盖侧栏点击、禁止态、最终路由和六权限隔离。记录 runtime error 也不等于把它作为失败门槛。
+
+**最小修复**
+
+- 明确区分“GoChat 独立 SPA 验证”和“上游兼容参考验证”，报告记录实际服务源与启动配置。
+- 独立 SPA fixture 使用 `__GOCHAT_CONFIG__` 契约，补非云/Cloud 两组场景。
+- 加入角色权限、flag 关闭与侧栏/直链断言；runtime error 与 unhandled rejection 纳入验收。
+- `--enterprise`/`enterpriseMode` 当前仍可作为功能测试组选择器；不是安装版本开关，不必为文字清理盲删。上一轮“已移除相关 Smoke 配置”的说法应收窄为删除 `isEnterprise`、`enterprisePlanName`、`IS_ENTERPRISE` 三个 fixture 字段。
+- 不把 route-request smoke 的成功描述为 Captain、支付或所有企业功能完成验证。
+
+**验收**：修复前能检测 R2/R3，修复后通过；有明确的权限/flag 负例；测试实际修改的 GoChat SPA。任何会执行 subscription/checkout 的验证只能在隔离测试账户、DB 和支付 fixture 中执行，不能打真实计费服务。
+
+### R6 · P1 · 未校验角色归属/有效性，且查询失败回退到 Agent 权限【旧安全缺陷】
+
+**证据链**
+
+- `backend/internal/service/agent_service.go` / `Create`、`Update`：校验 DTO 后直接传递 `custom_role_id`，未检查角色是否存活且属于目标账户。
+- `backend/internal/repository/agent_repo.go` / `UpdateAgentWithActive`：直接写入该 ID。
+- `backend/internal/service/rbac_service.go` / `GetCustomRole`：仅按 ID 读取角色。
+- `backend/internal/middleware/account_scope.go` / `AccountScopeWithService`：自定义角色读取或解析失败时，使用 `AgentDefaultPermissions`；`backend/internal/auth/policy.go` 的 Agent 默认权限包含会话/联系人读取，且会话读取允许回复。
+
+**触发与影响**
+
+1. 账户管理员提交其它账户的有效角色 ID，可以把外部角色权限及元数据关联到本账户成员；这不等于已经能访问其它账户的会话。
+2. 弹窗缓存角色 R，另一管理员删除 R，旧弹窗随后保存 R。无有效性校验会重新写入已删除 ID；后续读取失败时，原先仅报表/零权限用户可能得到会话、联系人和回复能力。
+3. 已分配角色的数据损坏/读取错误也可能触发同样的宽松回退。不是本次二值归一化造成的。
+
+**最小修复**：创建/更新服务复用同账户、未删除角色查询，失败时拒绝整个修改，避免部分姓名/身份已保存。授权解析同样校验账户范围，并在读取/解析失败时拒绝授权或返回明确服务错误，不能自动授予 Agent 权限；同步核对 `BuildPolicyContext` 的同类回退。合法删除已在事务内清空关联，不需要依赖错误回退实现转为 Agent。实现时保护角色校验与写入之间的删除竞争。
+
+**验收**：创建/更新分别覆盖外账户、不存在、软删除 ID，均无部分写入；查询失败/坏数据不能增加读取与回复权限；确定性复现“打开弹窗→删除角色→旧弹窗保存”；PostgreSQL 补删除/分配并发测试。并发调度本轮未实测。
+
+### R7 · P2 · 零权限角色 API 合法，但表单拒绝且路由循环【旧契约缺口】
+
+**证据**：`backend/internal/service/custom_role_service.go` 接受 `permissions: []`，profile 序列化为 `['custom_role']`。`CustomRoleModal.vue:49` 却要求至少一个权限；`frontend/app/javascript/dashboard/helper/routeHelpers.js:21-38` 在六权限均不匹配时退回 dashboard，而 `conversation.routes.js:6-12,48-52` 不允许只有 `custom_role` 标记的用户进入。独立评审用真实 Vue Router 的内存路由复现 `Infinite redirect in navigation guard`。新 SuperAdmin guard 也复用这一旧 fallback。
+
+**最小修复**：允许空复选框数组。无业务权限时复用已有 `/accounts/:accountId/profile/settings` 作为合法落点，该路由已允许 `custom_role`；不赠送会话权限，不新增角色维度。
+
+**验收**：创建/清空/仅改名的零权限角色；旧 all-none/未知维度角色；登录与直达受限/SuperAdmin URL 都能终止导航，且业务 API 保持拒绝。
+
+### R8 · P2 · 角色变更未刷新已登录用户的前端权限【旧一致性缺陷】
+
+**证据**：`frontend/app/javascript/dashboard/store/modules/customRole.js:51-77` 只更新角色记录；`agents.js:70-77` 只更新客服记录。`frontend/app/javascript/dashboard/routes/index.js:74-83` 复用初始化 profile Promise。角色变更没有通知受影响用户重新读取 profile；现有缓存失效监听只刷新 labels/inboxes/teams。
+
+**影响**：另一客户端编辑/删除角色后，已打开 SPA 的权限、菜单、路由仍可能过期，新增权限不可见或被收回的入口残留。正常请求中间件每次重新读取成员与角色，**不能把 UI 过期概括为后端继续允许已撤销权限**；R1/R6 是单独的问题。
+
+**最小修复**：复用 `auth.js` 的 profile 获取和路由校验路径，提交成功后通知受影响会话；已有 `page:reload` 处理器可作为低成本方案，不建立第二套权限缓存。若先采用 focus/reconnect/重新进入时刷新，应明确其延迟边界，不能声称即时生效。
+
+**验收**：两客户端进行角色编辑/删除/重新分配，受影响用户获得新 profile、正确菜单和合法路由；另行验证下一请求的后端权限。真实 WebSocket 撤权本轮未测。
+
+### R9 · P2 · 错误 PATCH envelope 返回成功但没有修改【旧后端契约缺陷】
+
+**证据**：`backend/internal/handler/api/v1/custom_role_handler.go` / `Update` 使用非必填值类型的 `custom_role` wrapper；缺失或 null 得到零值请求，`CustomRoleService.Update` 视为字段未提供，最终仍返回 200。上游 `docs/chatwoot/enterprise/app/controllers/api/v1/accounts/custom_roles_controller.rb:25` 明确要求 wrapper。
+
+**影响**：本次前端封装修好了正常调用，但其它调用方发送平铺权限撤销/改名请求时仍可能误以为成功。
+
+**最小修复**：创建/更新显式要求存在且非 null 的 envelope；保留合法 wrapper 内的部分更新，严格区分 permissions 未提供与 `[]`。
+
+**验收**：平铺、缺失、null wrapper 返回 4xx 且不修改；合法部分更新和 `[]` 成功。前端 API 测试同时验证真实账户作用域 URL，而不只检查测试用未带账户路径下的请求体。
+
+### R10 · P2 · 前一次删除完成会清空后一次确认状态【旧竞争，本次局部修复使 loading 问题显露】
+
+**证据**：`frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/Index.vue:79-81,103-126` 请求捕获删除 ID，但结束时通过当前 `activeResponse` 清理 loading 和选择。确认删除 A、打开 B 的确认框、再收到 A 的结果时，会清掉 B 的选择并遗留 A 的 loading。独立评审用实际组件回调的内存执行复现；继续确认 B 会传出 undefined ID，而不是已证明删错数据库记录。
+
+**最小修复**：按请求捕获的 ID 清理 loading；只有活动确认仍指向该 ID 才清空选择。或者简单串行化删除，不允许旧请求清理新弹窗。
+
+**验收**：延迟 A 的成功/失败回包并打开 B，A loading 正确结束，B 保留 ID/名称且只提交 B 的 ID。
+
+### R11 · P2 · 删除提示称“降级”，实际可能增加权限【新增误导文案】
+
+**证据**：`frontend/app/javascript/dashboard/i18n/locale/en/customRole.json:90` 使用 `downgrade`，中文同位置为“降级”。`backend/internal/repository/custom_role_repo.go:76-83` 实际转为默认 Agent，可能给仅报表/知识库/零权限成员增加会话、联系人和回复权限。
+
+**最小修复**：改成“重新分配为默认客服（Agent）角色，部分权限可能增加”，中英文一致。保留已约定的删除后转 Agent 行为，不暗中修改删除策略。
+
+**验收**：确认框明确提示权限可能增加；受限角色删除测试比较删除前后真实权限，不仅检查 `role=agent`、`custom_role_id=0`。
+
+## 4. 实施顺序与拆分
+
+| 阶段 | 内容 | 完成门槛 |
+| --- | --- | --- |
+| A · 权限安全 | R1、R6：原子身份转换、角色归属/有效性、失败时不扩大权限 | 实际 Agent 服务/handler 与下一请求拒绝断言；外账户/失效 ID 无部分写入 |
+| B · UI 与契约闭环 | R2、R3、R7、R9、R10、R11，分别小改动提交 | Billing 边界、错误恢复、零权限、envelope、删除竞争/提示各有负例 |
+| C · 会话权限刷新 | R8：复用 profile 与现有通知能力 | 两客户端验证；明确即时或延迟刷新边界 |
+| D · 业务开关一致性 | R4：逐项梳理策略与直链行为 | flags on/off、Cloud/非云、权限允许/拒绝矩阵通过 |
+| E · 验收工具可信化 | R5：真实源/配置契约、错误门槛、角色/部署负例 | 在隔离环境完成实际 UI 验证，报告写明来源与能力边界 |
+| F · 发布前核对 | 六权限、历史数据影响与角色生命周期回归 | 创建/编辑/分配/删除/重登录/已有会话均符合约定 |
+
+每阶段独立变更、独立测试。不要把翻译库、整个 Smoke 格式化或其它业务模块重写混进修复。涉及既有账号权限数据的批量修正，须在盘点后单独确认。
+
+## 5. 必补的回归矩阵
+
+- **身份**：administrator、agent、每一个单权限自定义角色、零权限角色、SuperAdmin、跨账户成员。
+- **生命周期**：创建、无改动编辑、增/删某个权限、分配、管理员降权、切回内置角色、删除被使用角色、刷新已有会话。
+- **异步状态**：空 Store 打开弹窗、角色请求慢/失败、重试成功、角色在弹窗打开期间被删除；均不得空引用、无反馈提交或误降级/提权。
+- **策略**：普通非云、定制品牌非云、Cloud；相关 flag on/off；侧栏展开/折叠、搜索入口、直接 URL。
+- **安全验收**：UI 不可见不是后端拒绝的替代品；profile 列出的权限、实际 API 的 403/允许结果和页面行为需一致。
+- **兼容**：旧 `read/full/none` 数据与未知维度、已有 API 路径、Paywall 与 SuperAdmin route guard。
+
+## 6. 本轮验证事实与未验证项
+
+本轮修复后已重跑：
+
+```bash
+cd frontend
+pnpm exec vitest run \
+  app/javascript/v3/helpers/specs/RouteHelper.spec.js \
+  app/javascript/dashboard/helper/specs/routeHelpers.spec.js \
+  app/javascript/dashboard/api/specs/customRole.spec.js \
+  app/javascript/dashboard/routes/dashboard/settings/customRoles/component/CustomRoleModal.spec.js \
+  app/javascript/dashboard/store/modules/specs/customRole/actions.spec.js \
+  app/javascript/dashboard/store/modules/specs/customRole/mutations.spec.js \
+  app/javascript/dashboard/components-next/sidebar/specs/SidebarGroupLeaf.spec.js
+
+cd ../backend
+GOCHAT_TEST_DB=sqlite go test ./internal/model ./internal/service ./internal/handler/api/v1 -run CustomRole -count=1
+
+cd ..
+git diff --check
+node --check backend/scripts/parity_frontend_browser_smoke.mjs
+node backend/scripts/parity_frontend_browser_smoke.mjs --self-test
+```
+
+- 定向 Go service/repository/handler/middleware 测试通过；Go build、go vet 通过。完整 service 包仍有既有 Captain 并发/PostgreSQL smoke 失败，不归因于本次改动。
+- 相关 Vitest、前端生产构建、Node/shell 语法和 Smoke 分类 self-test 通过；相关 JavaScript ESLint 目标文件通过，Sidebar 保留的既有全文件 Prettier 缩进问题未整体格式化。
+- 新增覆盖：Agent 自定义角色账户范围/管理员矛盾状态、CustomRole envelope、非云 Billing 直链、客服角色加载失败、零权限角色落点及删除状态竞争。
+- 事件写入已复用现有 `page:reload`，但未执行真实双客户端 WebSocket 权限刷新验收。
+- 未执行真实浏览器、PostgreSQL 端到端或支付/provider 验证；Smoke 已改为默认使用 GoChat `frontend/`，并支持 Cloud/非云部署 fixture 与 Billing/runtime-exception 门禁。
+
+## 7. 发布判断
+
+R1/R6 两项权限安全缺陷、R2/R3/R11 新增回归及 R7–R10 生命周期问题的最小代码修复已完成。完成真实浏览器、WebSocket、PostgreSQL 和支付/provider 边界验证前，仍不应宣称“角色权限生效流程已闭环、无版本判断后的前端验证完成”。R4/R5 单列为基线缺陷和验收债务，不冒充本次删除造成的后端权限漏洞。
+
+评审证据：工作流 `041489bb-e92b-45a3-ae71-57e7e5b26900`，两份只读结果为 `edition-review.md`、`rbac-review.md`，保存在本机 `/home/rogee/.pi/agent/sessions/--home-rogee-Projects-gochat--/subagent-artifacts/outputs/041489bb-e92b-45a3-ae71-57e7e5b26900/`。主要证据及方案已完整转录到本文，阅读本文不依赖该本机目录。
diff --git a/docs/plans/2026-09-12-shangwutong-capability-gap-repair-plan.md b/docs/plans/2026-09-12-shangwutong-capability-gap-repair-plan.md
new file mode 100644
index 00000000..fb33ab23
--- /dev/null
+++ b/docs/plans/2026-09-12-shangwutong-capability-gap-repair-plan.md
@@ -0,0 +1,295 @@
+# 商务通消息与联系人/会话资料能力缺口修复计划
+
+> 日期：2026-09-12  
+> 状态：已完成文档补缺审查；修复待实施，范围决策待确认；现有自动化基线通过不代表新增能力完成。
+>
+> 审查基线：`main@6e62f5094fa2381c5b283eeb9be3f94a95096f1c` 加 2026-09-12 当前未提交工作树（包括分类相关改动），不是纯 HEAD 或已发布版本。
+>
+> 总计划：[`2026-07-31-shangwutong-connector-development-plan.md`](2026-07-31-shangwutong-connector-development-plan.md)  
+> 分类计划：[`2026-09-11-shangwutong-classification-sync-plan.md`](2026-09-11-shangwutong-classification-sync-plan.md)
+
+## 1. 目的
+
+补齐商务通 Connector 在以下方面的产品和技术缺口：
+
+- 消息收发后的资料一致性与历史能力边界；
+- 联系人姓名、远程联系人备注 `cnote`；
+- 商务通会话分类、客户颜色分类；
+- GoChat 原生 Contact Label、Conversation Label、Contact Note；
+- CRM 客户标签与商务通分类之间的边界；
+- 失败、重试、权限、幂等和真实账号灰度验收。
+
+## 2. 当前基线与概念边界
+
+### 2.1 已有基线
+
+- 文本、图片、文件、语音、状态、撤回、输入状态以及部分会话控制已有 Connector 链路。
+- 联系人 CID 按 `(inbox, source_id)` 保存在 `ContactInbox.ChannelMetadata`。
+- 联系人姓名已有 GoChat → Connector → 商务通 `changecname.aspx` 的异步链路。
+- 商务通分类 catalog、缓存、会话分类出站操作和结果回写已有实现。
+- GoChat 原生联系人备注、联系人标签、会话标签已有本地 API 或前端能力。
+
+### 2.2 必须保持独立的概念
+
+| 概念 | 存储/接口 | 本计划中的处理 |
+| --- | --- | --- |
+| 商务通 `visitors.chatkind` | 商务通会话分类 | 不转成 GoChat Conversation Label |
+| 商务通 `visitors.colors` | 商务通客户级颜色分类 | 不转成 Contact Label 或 CRM 标签 |
+| GoChat Contact Label | `Tag`/contact-label 关系 | 仅 GoChat 本地能力 |
+| GoChat Conversation Label | 普通更新链路为 `conversations.labels`；另有 conversation-label 关系路径 | 仅 GoChat 本地能力；需修复响应契约并核对两条路径一致性（R13） |
+| GoChat Contact Note | GoChat 联系人备注记录 | 不自动写入商务通 `cnote` |
+| 商务通 `cnote` | 商务通远程联系人备注 | 单独设计双向协议，不能隐式复用 Contact Note |
+| CRM 客户标签 | `CategoryInFo`、`ClientLabelConfig` 等 | 本期不与商务通分类互相转换 |
+
+## 3. 修复清单
+
+| ID | 优先级 | 状态 | 缺口与目标 |
+| --- | ---: | --- | --- |
+| SWT-R01 | P0 | 待产品确认 | 冻结 `cnote` 是否纳入范围，以及它与 GoChat Contact Note 的关系；若不做，必须在 UI/API/文档中明确“不支持”。 |
+| SWT-R02 | P0 | 待实施 | 先验证并阻断现有改名发送空 `cnote` 造成远程备注丢失的风险，此安全项不依赖 R01；双向编辑仅在 R01 批准后补齐输入、持久化、出入站映射、冲突和失败处理。 |
+| SWT-R03 | P1 | 待实施 | 补齐联系人姓名修改的最终状态回写。远程 rename 的成功、失败、不确定结果必须能回到 GoChat，并在 UI 中呈现 pending/failed/uncertain；不能在 Connector 接受 202 后视为远程成功。 |
+| SWT-R04 | P1 | 待实施 | 处理姓名修改与 CID 获取之间的竞态。缺少 CID 时不得静默丢弃；应延迟到 CID 可用后重放，或向用户返回明确不可执行状态。 |
+| SWT-R05 | P1 | 待实施 | 补齐商务通远程 `chatkind` → GoChat 的入站同步，并区分远程事件与 GoChat 发起操作的确认回调。 |
+| SWT-R06 | P1 | 待实施 | 明确客户颜色的渠道客户级作用域。至少以 `(account_id, inbox_id, CID)` 隔离，关联 `(inbox_id, source_id)`；在同一远程身份范围传播到相关会话，统一 ID/名称，禁止裸 CID 跨站点归并。 |
+| SWT-R07 | P1 | 待确认 | 审核会话分类修改的角色权限；Connector 服务鉴权和资源范围已有，但分类修改方法未见独立角色级限制。 |
+| SWT-R08 | P2 | 待实施 | 在商务通会话联系人侧栏补充 GoChat 原生 Contact Label 的入口（如产品需要），但保持其与商务通颜色分类完全独立。 |
+| SWT-R09 | P2 | 待实施 | 当前联系人备注 HTTP 路由实际使用 `ContactService → NoteRepo → notes`；先盘点 `contact_notes` 历史数据及写入方，无迁移/回滚证据不得删表；补齐 API/store 和会话侧栏、联系人详情两处编辑 UI。 |
+| SWT-R10 | P2 | 待确认 | 分别冻结 kind=52 被动历史正文导入、主动历史拉取、消息编辑、反应四项范围；当前 kind=52 仅提取 CID，不导入历史正文，亦无完整主动分页历史 API。 |
+| SWT-R11 | P1 | 待实施 | 增加跨系统端到端测试和真实账号灰度验证，覆盖姓名、`cnote`、CID、分类、多会话和失败重试。 |
+| SWT-R12 | P2 | 待实施 | 补充 README、runbook 和分类计划中的能力矩阵、错误状态、未支持项和灰度验收证据。 |
+| SWT-R13 | P1 | 待实施 | 修复原生会话标签更新返回对象、前端预期数组的契约不匹配；验证普通更新、批量增删、筛选、GET、序列化的数据源一致性。 |
+| SWT-R14 | P1 | 待实施 | 资料操作和 catalog 同步补持久化关联、重复/乱序保护、原子更新及最终状态；验证事件 ID 不等于验证操作真实存在，旧回调不得覆盖新值。 |
+| SWT-R15 | P1 | 待实施 | 补联系人合并/软删除、inbox 删除/停用/重绑定、配置版本变化时，资料归属与 pending 操作/旧回调的迁移或终止规则。 |
+| SWT-R16 | P1 | 待实施 | 补原生姓名/备注/标签/合并/删除的真实路由权限、父联系人有效性与跨租户校验；复用现有六个二值权限，不新增三态或 CE/EE 限制。 |
+| SWT-R17 | P1 | 待实施 | 补分类组件切换会话竞态、独立操作状态、延迟确认、catalog 失效及刷新后恢复；旧请求不得更新新会话 UI。 |
+| SWT-R18 | P1 | 待实施 | 复用现有操作结果队列补 rename、结果重试耗尽补偿、catalog 回传失败可恢复性；保留不确定证据，补账号级队头阻塞监控与恢复验收。 |
+
+### 3.1 审查确认的具体缺口
+
+以下为静态证据，不表示已通过失败复现测试；实现时以符号和实际工作树复核，不能将本节直接计为修复完成。
+
+| 证据位置 | 当前事实 | 补充约束 |
+| --- | --- | --- |
+| `ConversationHandler.UpdateLabels`；`dashboard/store/modules/conversationLabels.js`；上游 `conversations/labels/create.json.jbuilder` | 更新返回 `payload: {conversationId, labels}`，store 直接保存 payload，消费者需要数组；上游返回数组 | R13 修复真实响应；mock action 测试通过不足以证明兼容 |
+| `ShangwutongConnectorHandler.UpdateClassificationStatus` | 校验幂等 header 和 event_id 的拼接，但未核对持久化 pending 操作；读改写整份 `additional_attributes` | R14 绑定实际操作、目标及字段，防伪造关联、重复、乱序和丢失并发属性 |
+| 同上；`UpdateClassificationCatalog/UpdateClassificationSyncStatus` | 会话分类与颜色共享一个状态槽；catalog 仅记最近成功 event_id，失败回调无代际约束 | 不同操作不得互相吞状态，旧失败不能覆盖新同步成功，重复回调不刷新版本 |
+| `ShangwutongClassifications.vue` 的 `waitForConfirmation/fetchClassifications` | 保存后最多 10 次、间隔 500ms 查询；异步流程持续读取当前 props；未确认后仍可再次操作 | 固定请求目标并忽略失效响应；区分仍 pending、failed、uncertain，刷新后可恢复，不能因前端等待结束判失败 |
+| `ContactLabels.vue` 的 mounted/watch | 初次加载依赖路由 contactId，而会话侧栏可能只传 prop | R08 复用组件前补首次 prop 加载、切换隔离；全量替换标签前必须读到完整旧集合 |
+| `ContactService.GetNote/UpdateNote/DeleteNote`；上游 contacts/base_controller | 单条操作检查备注归属，但未统一加载有效父联系人；上游先加载账户内联系人 | R16 补软删除后的单条访问负向用例，与列表/新增语义一致 |
+| Connector `swt/operations.go:ChangeContactName`；参考 Android `RenamedThread.java` | Go 实现显式发送 `cnote: ""`，Android 传入调用者提供的备注；服务器清空语义尚未实测 | R02 不能断言一定清空或认定空值安全；缺省/空串/原值三种形态必须有协议证据 |
+| Connector `delivery/inbound.go`、`db/queries/inbound.sql` | 已有 CID→GoChat 的延期回调，联系人尚未创建可等待至事件创建后 24 小时；不是缺 CID 时的人工改名意图队列 | R04 保留已有机制，仅补相反方向缺口及到期处置 |
+| `db/queries/operations.sql`、`delivery/outbound.go` | 结果队列目前仅覆盖分类/颜色；回调达 10 次后进入 failed，重启仅恢复 syncing；pending/syncing 结果会阻挡同账号后续操作 | R18 扩展现有机制，补仅重放结果的人工补偿，不重复远程写 |
+| 同上 | uncertain 观察窗口为 5 分钟，超时写 failed/`uncertain_timeout`；依赖的 updated_at 也会被回调重试更新 | 超时仍非远程拒绝证据；固定截止需独立时间字段，不能让重试无限延后观察窗口 |
+| `account/manager.go:SyncClassifications`、`httpapi/server.go` | catalog 同步直接执行并回传，失败状态回传错误被忽略，不走分类操作结果队列 | R18 单独补 catalog 故障恢复，不能套用业务操作持久回传保证 |
+
+### 3.2 实施前必须冻结的契约
+
+- **身份与来源**：全局 `Contact.Name` 人工修改当前会广播到该联系人关联的多个商务通 inbox；远程入站姓名如何影响全局展示须确认。`cnote`、颜色和远程操作按渠道身份隔离，不因 Contact 合并而把不同站点资料混合；同时记录 SID、CID、source_id 和会话内部 ID/display_id 的用途，禁止靠 CID 或 display_id 猜测目标。
+- **字段语义**：`cnote` 缺失/未知 = 不修改，显式空值 = 请求清空（仅在协议验证且有权限时）；姓名仅改名必须保留远程备注。缺字段不得覆盖已有姓名、备注或颜色；规定长度、编码、多行/特殊字符、日志脱敏和安全渲染。若远程接口强制带备注且无法安全保留，明确拒绝改名，而不是发送空串冒险。
+- **状态与一致性**：受理/持久化成功才返回 202；`pending → succeeded/failed/uncertain` 必须来自远程证据。超时不是失败或成功；结果回传重试不重新执行远程写。操作 ID 关联租户、inbox、配置/绑定代际、字段、目标值和原始操作者；不复用事件时间戳冒充可比较版本。
+- **并发与重放**：同一远程身份同一字段按确定顺序执行或串行确认，不让旧命令最后写回远程；不同字段允许独立状态。重复同键同负载返回同一结果，同键不同负载拒绝；未知/错目标/错 operation 的结果拒绝。终态重复幂等，旧结果不得回退新值；外部事件没有可靠版本时先冻结冲突/重新读取策略，不能用本机接收时间假定远程先后。
+- **持久化边界**：本地资料变更、待执行操作及待发事件不得在崩溃时留下无法发现的半状态；复用现有队列/outbox。定义排队/等待 CID/回调重试的截止、退避、最大尝试、告警与人工处理入口；具体配置和负责人在灰度前登记，不凭空承诺时限。重放期间再次修改姓名只按冻结的最新版本/串行策略执行，不补发过期值。
+- **生命周期**：合并后的原生标签保留策略需确认，上游并未在合并动作中明确标签并集，不能假称上游已有保证。软删除联系人后禁止通过旧 ID 操作资料；GoChat 删除不等于删除商务通客户。inbox 停用/删除/重绑及配置代际变化后，旧操作必须停止或经显式重新授权重建，不能投递到新站点。
+- **授权与范围**：普通座席、管理员、自定义角色和 Connector 服务主体逐接口列允许/拒绝；分别验证 `contact_manage`、`conversation_manage` 等现有二值 key 及 inbox/会话可见范围。服务签名和资源绑定不是用户管理权限；产品待决项保持未批准，不由本文默认为新增功能授权。
+
+## 4. 实施阶段
+
+### 阶段 0：契约和产品决策
+
+- [ ] 决定 `cnote` 是否进入本期；若进入，定义字段长度、空值、权限、审计、冲突方向和删除语义。
+- [ ] 明确 GoChat Contact Note 是否永远只作为 CRM 内部记录，禁止自动映射到 `cnote`。
+- [ ] 冻结客户颜色的渠道客户级作用域，以及同一账号/inbox/CID 多会话的展示/更新规则；验证跨 inbox 同 CID 不互相覆盖。
+- [ ] 完成 §3.2 契约评审并登记负责人、决策日期、操作超时/恢复配置与验收责任人；未决功能默认不开放，但 R02 的备注保全、R13 的现有响应错误不因新功能决策而延期。
+- [ ] 冻结远程消息历史、编辑、反应能力的本期范围；不实现的能力必须列入“不支持”清单。
+- [ ] 明确普通座席、管理员和 Connector 服务主体分别可以执行哪些操作。
+
+### 阶段 1：联系人姓名、CID 与远程备注
+
+- [ ] 先为“仅改姓名、不损坏已有远程备注”建立协议门禁；协议未知时阻止危险请求，不能等待双向备注获批再处理。
+- [ ] 仅在 R01 批准后扩展 `contact_updated` 及消费端 `cnote` 解码、入站映射和持久化；单加 webhook 字段不足以打通链路。
+- [ ] 为 rename 建立可查询的 GoChat 结果状态：`pending`、`succeeded`、`failed`、`uncertain`；复用 `outbound_operations` 终态/结果回传，不新建一套通用调度系统。
+- [ ] 结果回调具有幂等键和持久重试；远程已执行但响应丢失维持不确定、禁止自动重发副作用。超过结果补传上限可告警并仅重放原结果，重启不等于死信已恢复。
+- [ ] CID 缺失时将姓名修改放入待处理队列；CID 到达后按联系人/inbox/source 幂等重放。
+- [ ] 对远程入站姓名/备注更新增加来源标记，避免把远程同步误判为新的人工修改。
+
+### 阶段 2：商务通分类一致性
+
+- [ ] 先取得远程 `chatkind`/姓名/备注事件的真实脱敏样本或可靠协议证据，再实现解析、定位和更新；kind=18/19/20 在现有映射与参考字典中未确认，继续 raw-only，禁止按数字或图标资源名猜语义。
+- [ ] 分别验证 catalog 同步、业务字段入站、出站写入及结果回传；kind=29 空颜色的入站证据不能替代出站 `RESET` 协议验收。
+- [ ] catalog 请求失败且失败状态回传也失败时仍可追踪/恢复；区分同步请求受理与目录已更新，不无限保留虚假 syncing。
+- [ ] 将客户颜色分类的远程 ID、名称和显示值统一成明确的数据契约。
+- [ ] 以 `(account_id, inbox_id, CID)` 维护客户级颜色状态；仅同一远程身份的相关会话读取同一确认值。若暂不支持多会话传播，必须明确降级且不得将 R06 标为完成。
+- [ ] 分类修改失败/不确定时保留明确状态，不显示虚假成功。
+- [ ] 评估并实现 `RESET` 清除能力；协议未验证前继续保持禁用。
+- [ ] 为分类修改补充角色权限校验和跨 inbox/跨 account 负向测试。
+- [ ] R14：保存实际 pending 操作并核对结果关联；catalog 请求/回调按代际处理，原子更新属性，不丢并行消息/分类产生的无关字段。
+- [ ] R17：分类与颜色分别展示已确认值、请求值、pending/失败/不确定；切换会话/inbox/卸载后旧查询不可污染当前 UI。catalog 名称变更、ID 删除/未知/过期和失败后旧缓存的可用策略须明确。
+
+### 阶段 3：GoChat 原生资料能力
+
+- [ ] 保持商务通分类与 Contact Label、Conversation Label、CRM 客户标签不互相转换。
+- [ ] 如产品确认需要，在商务通会话联系人侧栏显示 Contact Label；标签操作仍只调用 GoChat 原生 API。
+- [ ] 以当前 HTTP 链路 `notes` 为基线，盘点 `contact_notes` 的历史记录和全部写入方；若需迁移，使用编号 SQL 迁移，处理账户归属、ID 冲突、作者缺失，核对记录数/内容/作者/时间并验证备份恢复。证据不足只标记弃用，不删表、不启动双写。
+- [ ] 补 contactNotes API/store 的 update，再接会话侧栏和联系人详情两处 UI；失败保留草稿，不显示虚假成功，切换联系人不串写。
+- [ ] R13：统一会话标签 GET/更新的 `payload: string[]` 契约，覆盖普通/批量更新、关联移除、筛选、重新进入页面和空数组清空；选择与现有读写兼容的最小修复，不先做无关表结构重构。
+- [ ] R08：联系人标签组件以 prop 正确首次加载，加载失败禁用基于空集合的替换；区分移除联系人关联与删除账户标签。
+- [ ] R15/R16：所有原生资料入口统一有效父联系人、角色及资源校验；补 pending 时合并/删除和旧回调场景。
+
+### 阶段 4：消息能力边界
+
+- [ ] 分开决定 kind=52 被动历史正文导入和主动历史拉取；现有 `mapping_test.go` 明确锁定 kind=52 仅取 CID，新增正文导入需同步修改契约测试，而不是把测试通过当作已支持历史。
+- [ ] 若批准被动导入，校验多条消息、原始消息 ID、时间/时区、发送者方向、嵌套/损坏字段、附件及撤回；与实时 kind=2/3 去重，历史补录不得触发新消息通知、未读累加或新的自动回复。
+- [ ] 若批准主动拉取，另行冻结远程接口可用性、权限、分页/断点、停止条件、流量限制与去重；不能仅凭收到了 kind=52 宣称支持拉取。
+- [ ] 未批准/未实现的被动历史正文导入、主动历史读取、消息编辑和反应逐项在 UI/API/README 标不支持，不以 2xx 空结果冒充支持。
+- [ ] 保持现有消息发送的 progress/sent/failed/uncertain 语义，不因 HTTP 202 直接显示已发送。
+
+### 阶段 5：验证、灰度和发布门禁
+
+- [ ] 单元测试覆盖协议解析、空值、重复事件、CID 竞态、ID/名称规范化和 RESET。
+- [ ] 集成测试覆盖：
+  - [ ] GoChat 改名 → webhook → Connector → 商务通接口 → 结果回写；
+  - [ ] 商务通改名/备注 → Connector → GoChat；
+  - [ ] 无 CID、CID 延迟到达、重复 webhook、超时和不确定结果；
+  - [ ] 同一账号/inbox/CID 多会话的客户颜色一致性，以及跨 inbox 同 CID 隔离；
+  - [ ] 远程分类与原生标签/CRM 标签互不污染；
+  - [ ] 备注 UI 与实际数据库表一致。
+- [ ] 增加 `ShangwutongClassifications.vue` 组件级测试。
+- [ ] 真实账号灰度验证至少覆盖一个改名、一个颜色分类、一个会话分类、失败重试和同 CID 多会话。
+- [ ] 灰度通过后再将对应条目标记为完成；自动化测试通过不等于真实商务通协议已验收。
+
+## 5. 验收标准
+
+### 5.1 姓名与备注
+
+- 人工改名最终能看到远程成功或明确失败/不确定状态。
+- 缺少 CID 不会静默丢失改名请求。
+- 商务通入站姓名/备注不会触发无意义的反向人工修改。
+- `cnote` 若纳入范围，GoChat 与商务通双向更新、空值和冲突语义均有测试；若不纳入，所有入口明确拒绝或隐藏。
+- GoChat Contact Note 不会被隐式写入商务通 `cnote`。
+
+### 5.2 分类与标签
+
+- `chatkind` 和客户颜色能分别读取、修改、确认和报告失败。
+- 客户颜色在同一账号/inbox/CID 多会话中的展示符合冻结作用域，跨渠道同 CID 不串写；远程确认值与本地待提交值分开。
+- 商务通分类不会创建、删除或修改 GoChat Contact Label、Conversation Label 或 CRM 标签。
+- 原生标签删除仍只影响 GoChat，不调用商务通分类接口；更新响应必须可被真实 store/composable 直接消费，两套读写入口一致，不能仅通过 mock 测试。
+- 未同步 catalog、失效 CID、无权限和跨 inbox 请求均有明确错误。
+
+### 5.3 消息
+
+- 已支持的消息类型继续保持持久化队列、幂等和最终状态回写。
+- 历史读取、编辑、反应若未实现，文档和 UI 不得暗示已支持。
+
+## 6. 能力验证与发布门禁
+
+### 6.1 当前能力矩阵
+
+“已有链路”仅说明源码/现有测试存在，不等于真实账号验收；未提供真机证据的项目均不得宣传为已完成。
+
+| 能力 | 当前状态与边界 | 修复/验收索引 |
+| --- | --- | --- |
+| 实时消息及最终状态 | 已有链路；本轮只跑本地回归，未重新验证所有真实消息类型 | R10/R11，V23/V24 |
+| kind=52 被动历史 | 仅提取 CID，不导入历史正文；保留原始事件不等于页面可读历史 | R10，V21 |
+| 主动历史拉取、编辑、反应 | 未见完整能力；逐项待范围确认，不能与撤回混同 | R10，V22 |
+| 人工姓名出站 | 已有异步执行；缺最终状态、缺 CID 意图保全，另有空备注风险 | R02–R04/R18，V01/V03–V06 |
+| 远程姓名/备注入站 | 事件字段/来源与冲突契约待验证，不把普通消息带姓名当作完整资料事件同步 | R01/R02，V02/V07 |
+| `cnote` 双向编辑 | 未实现、未获范围确认；独立于 Contact Note | R01/R02，V01/V02 |
+| 分类 catalog | 有读取/缓存/手工同步；失败回传和同步代际保证不完整 | R14/R18，V11/V12 |
+| 会话分类出站 / 远程入站 | 出站及结果队列已有；独立远程修改事件尚待证据与实现 | R05/R14，V07–V09 |
+| 客户颜色入站/出站 | kind=29 当前只写会话文本属性；出站已有，客户级传播和 ID/名称一致性未完成 | R06，V10/V12 |
+| 分类/颜色清除 | 出站 RESET 仍禁用，需单独协议门禁 | R05/R06，V13 |
+| 原生 Contact Label | 本地能力已有；商务通侧栏入口待确认及首次加载修复 | R08，V16 |
+| 原生 Conversation Label | 本地链路已有，但响应与 store 不匹配，数据源一致性待核对 | R13，V15 |
+| 原生 Contact Note | 当前 HTTP 使用 notes；编辑 API/store/UI、历史表安全及有效父联系人待补 | R09/R16，V17/V18 |
+| CRM 标签 | 保持独立，本期不新增映射或同步 | R12，V19 |
+
+### 6.2 必须新增或补齐的验收矩阵
+
+状态统一为**待实施/待验证**，不能因 §6.3 旧测试通过直接勾选。每条最终需登记测试路径/命令、环境、结果、操作者、时间与证据位置；范围未批准的条目标记“不纳入＋决策记录”，不是“通过”。P0 安全与权限负向用例不可用不纳入规避。
+
+| 编号 | 修复项 | 场景与通过标准 | 所需证据层级 |
+| --- | --- | --- | --- |
+| V01 | R02 | 远程已有非空 cnote，只改姓名；验证缺省/空串/原值请求形态，不丢备注；协议不明时明确阻止 | 协议 fixture＋经授权真实账号 |
+| V02 | R01/R02 | 若批准 cnote：双向新增/修改/清空、缺失不覆盖、中文多行/特殊字符/超长拒绝、并发冲突；本地 Note 不外泄 | 单元＋跨服务＋真实账号 |
+| V03 | R03/R04 | 改名前无 CID、CID 延迟/先于联系人到达、期间连续改名、24h 到期、重启恢复；意图不丢、旧值不反盖 | 持久队列集成＋UI |
+| V04 | R03/R18 | 202 仅受理；真实成功/明确拒绝/响应丢失分别显示 succeeded/failed/uncertain；刷新保留最终状态 | 跨服务＋真实账号 |
+| V05 | R14/R18 | 远程成功后本地终态提交前/后、回调前/后分别崩溃；已确认执行只补结果，无法确定执行保留不确定 | 故障注入＋远程调用计数 |
+| V06 | R18 | 回调连续失败至 10 次耗尽、再恢复；可见死信并仅重放结果；覆盖另一 SID 的账号队头阻塞和固定不确定截止 | 队列集成＋告警/补偿记录 |
+| V07 | R02/R05 | 远程独立改名/备注/chatkind；来源标记阻止反向循环；未验证的 kind18/19/20 仅保留 raw，不污染资料 | fixture＋真实事件样本 |
+| V08 | R14 | 重复同键同值/同键异值、未知操作、错字段/错目标/旧代际回调；只接受实际操作且拒绝冲突关联 | 真实路由集成 |
+| V09 | R14/R17 | A→B 连续修改、B 后收到 A 回调、颜色与分类并行、同时消息更新属性；不回退、不丢无关属性、状态互不覆盖 | PostgreSQL 并发＋组件 |
+| V10 | R06 | 同账号/inbox/CID 多 SID 传播；跨账号/inbox 相同 CID、合并联系人多个渠道身份不串写 | PostgreSQL＋真实账号 |
+| V11 | R14/R18 | catalog 远程读取失败、失败状态回传失败、重复成功、旧失败晚到、进程重启；状态可恢复且旧代际无效 | 跨服务故障注入 |
+| V12 | R06/R17 | catalog 未同步/空列表/过期/ID删除/重命名、kind29空值/未知ID；保留远程 ID，按约定显示未知或清除 | 协议 fixture＋组件 |
+| V13 | R05/R06 | 分类与颜色 RESET 分别验证远程请求及回读；未通过时按钮不可用且服务端拒绝 | 负向自动化＋授权真实账号 |
+| V14 | R07/R16 | 普通座席/管理员/六维自定义角色/服务主体，越权 account/inbox/contact/SID/display_id、过期/篡改签名及旧配置；无权请求无副作用 | 挂载真实 middleware 的路由集成 |
+| V15 | R13 | 真实 GET/POST/PATCH 标签响应进入 store/composable；数组 .includes 可用，普通/批量更新、筛选、清空、重载一致 | API 契约＋跨层前端测试 |
+| V16 | R08 | 仅 prop 首次加载、切换联系人、加载失败后尝试更新、已有标签保留、移除关联；不调用商务通 | 组件＋API 调用断言 |
+| V17 | R09/R16 | 两处备注 UI 新增/编辑/删除、失败保留草稿、跨租户/软删除父联系人拒绝；作者/时间/权限正确 | 真实路由＋组件 |
+| V18 | R09/R15 | 若迁移：两表历史数据、作者缺失、ID冲突、联系人合并；数量/内容/归属不丢，备份可恢复，数据盘点未完成不得迁移删表 | 隔离 PostgreSQL 迁移/回滚 |
+| V19 | R01/R08/R12 | 原生标签/备注/CRM 操作不得触发商务通字段更新；商务通事件不得创建/删除这些原生资料 | 跨服务负向调用断言 |
+| V20 | R15 | pending 时联系人合并/删除/重建、inbox 删除/停用/重绑、配置换代；旧操作停发且旧回调不写新对象 | 生命周期集成 |
+| V21 | R10 | 若批准 kind52 正文：同事件多条/重复、与实时消息重叠、时区/方向/损坏字段/晚到撤回；无重复、串会话、新通知或自动回复 | 历史 fixture＋跨服务 |
+| V22 | R10/R12 | 若批准主动历史：分页、断点、停止/限流、鉴权、去重；否则历史正文/主动拉取/编辑/反应入口分别隐藏或明确拒绝 | 范围决策＋API/UI |
+| V23 | R11/R17 | 分类/颜色超过前端约 5s 等待、浏览器刷新、A会话切B、卸载、快速连点、失败重试；无虚假成功/串页/重复提交，键盘和错误提示可用 | 组件＋授权测试环境浏览器 |
+| V24 | R10/R11 | 文本/图片/文件/语音、撤回先后、输入状态及会话控制回归；保留幂等与 progress/sent/failed/uncertain，资料修复不改变消息语义 | 现有自动化＋授权真实账号 |
+| V25 | R02/R11/R18 | 全链路以操作 ID 关联但不记录明文姓名/备注/token/签名；日志、错误/UI 不泄露跨租户数据，补偿可审计 | 日志检查＋负向测试 |
+
+### 6.3 本轮实际执行的验证（2026-09-12）
+
+以下命令从仓库根目录分别运行；只验证当前工作树既有代码，**本轮未新增业务代码或回归测试**。
+
+```bash
+# Connector 全部现有测试；额外对关键包禁用缓存复跑
+(cd channels/shangwutong && go test ./...)
+(cd channels/shangwutong && go test -count=1 ./internal/swt ./internal/delivery ./internal/store ./internal/httpapi ./internal/account)
+
+# 后端：SQLite 定向；不包含生产 PG 并发/迁移验收
+(cd backend && GOCHAT_TEST_DB=sqlite go test ./internal/service ./internal/handler/api/v1 \
+  -run 'Test.*(Shangwutong|ContactUpdate|ContactNote|ContactLabel|ConversationLabel)' -count=1)
+
+# 前端：既有 store 与 inbox 设置测试，不包含尚未补的分类组件测试
+(cd frontend && TZ=UTC pnpm exec vitest run \
+  app/javascript/dashboard/store/modules/specs/contactLabels \
+  app/javascript/dashboard/store/modules/specs/contactNotes \
+  app/javascript/dashboard/store/modules/specs/conversationLabels \
+  app/javascript/dashboard/routes/dashboard/settings/inbox/channels/specs/Shangwutong.spec.js \
+  --maxWorkers=2 --minWorkers=1)
+```
+
+| 检查 | 本轮结果 | 不覆盖的内容 |
+| --- | --- | --- |
+| Connector 全套及五个关键包无缓存复跑 | 通过 | 真实服务 cnote/事件编号/RESET/历史语义；新增 V01–V25 |
+| 后端两个包定向测试 | 通过 | 完整 RBAC 路由、PG 并发/迁移、修复后的新契约 |
+| 前端 | 10 文件、33 测试通过 | 标签真实后端响应、分类组件竞态、备注编辑和浏览器 E2E |
+| 上游及本地源码对照 | 已核查并登记 §3.1 | 静态缺口不等于已运行失败复现测试 |
+
+本地基线日志/改前备份位于 `/tmp/gochat-swt-plan-review-20260912/`（临时证据，不是 CI 长期归档）；关键包无缓存复跑记录见本次 Connector 只读审查产物。合入/发布前必须把有效验收证据归档到团队可访问的 CI 或报告位置，并记录确切提交/工作树版本。原生标签 action mock 通过不能抵消 R13 的真实契约缺口。
+
+本轮未做：真实商务通登录/写入、浏览器 E2E、生产 PostgreSQL 并发/迁移、故障注入、灰度/部署。所有新增验收项仍待验证。
+
+### 6.4 发布、观察与回滚
+
+- **进入实施**：R01/R07/R08/R10 等范围或权限待决项留明确决策，不擅自开放；R02 数据保全及现有错误修复优先。接口字段/状态以冻结契约为准，不在多份文档各维护不同版本。
+- **进入灰度**：适用 V01–V25 全部有自动化证据；涉及远程语义的 fixture 必须能追溯脱敏样本。备份、迁移回滚、结果补偿、操作审计及真实账号授权齐备，协议未知的能力继续关闭。
+- **真实验证**：登记专用测试站点/inbox、允许写入对象和原值、执行人、测试时间及恢复步骤；至少验证姓名且已有非空备注、会话分类、颜色、多 SID、一项失败/不确定与仅结果补传。不获授权不操作真实客户，不用反复写入推测远程结果。
+- **灰度观察**：按 inbox 查看 pending 数/最老年龄、缺 CID 到期、明确失败与 uncertain_timeout、回调重试/耗尽、catalog 最后成功时间与故障、账号队头阻塞；告警阈值、观察窗口和负责人在放量前填写，未填写不放量。
+- **停止条件**：备注误清空、跨租户/渠道串写、旧结果覆盖、重复远程副作用、迁移数据不一致立即停止对应出站功能；保存队列和审计证据，不能清空队列掩盖问题。代码回滚不撤销远程写入，恢复原值须核对远程当前值并重新授权。
+- **退出灰度**：范围内适用用例真实验证完成、无未处理 P0/P1、数据库兼容/回滚与结果补偿演练通过、README/runbook/能力矩阵一致，才逐项标记完成。仅本轮现有测试通过不可发布宣称新增能力。
+
+## 7. 关联实现位置
+
+- 联系人更新事件：`backend/internal/service/contact_service.go`
+- 商务通联系人监听：`backend/internal/service/shangwutong_contact_listener.go`
+- 联系人 webhook：`backend/internal/service/shangwutong_webhook_delivery.go`
+- Connector webhook 接收：`channels/shangwutong/internal/httpapi/server.go`
+- 入站映射：`channels/shangwutong/internal/delivery/mapping.go`
+- 联系人/消息 API client：`channels/shangwutong/internal/gochat/messaging.go`
+- 商务通姓名操作：`channels/shangwutong/internal/swt/operations.go`
+- 分类处理：`backend/internal/handler/api/v1/shangwutong_connector_handler.go`、`frontend/app/javascript/dashboard/routes/dashboard/conversation/ShangwutongClassifications.vue`
+- GoChat 原生备注/标签：`backend/internal/service/contact_service.go`、`frontend/app/javascript/dashboard/routes/dashboard/conversation/contact/ContactNotes.vue`、`frontend/app/javascript/dashboard/components-next/Contacts/ContactLabels/ContactLabels.vue`、`frontend/app/javascript/dashboard/routes/dashboard/conversation/labels/LabelBox.vue`
+- 标签真实契约：`backend/internal/handler/api/v1/conversation_handler.go`、`backend/internal/service/conversation_service.go`、`frontend/app/javascript/dashboard/store/modules/conversationLabels.js`、`frontend/app/javascript/dashboard/composables/useConversationLabels.js`
+- 操作持久化/恢复：`channels/shangwutong/db/queries/operations.sql`、`channels/shangwutong/db/queries/inbound.sql`、`channels/shangwutong/internal/delivery/outbound.go`、`channels/shangwutong/internal/account/manager.go`
+- 联系人合并与历史备注：`backend/internal/repository/contact_merge_repo.go`、`backend/internal/model/note.go`、`backend/internal/model/contact_note.go`
+- Chatwoot 只读对照：`docs/chatwoot/app/controllers/api/v1/accounts/contacts/notes_controller.rb`、`docs/chatwoot/app/controllers/concerns/label_concern.rb`、`docs/chatwoot/app/views/api/v1/accounts/conversations/labels/create.json.jbuilder`、`docs/chatwoot/app/actions/contact_merge_action.rb`
+- 商务通协议只读证据：`reference/shang-wu-tong/docs/20260629-kind-value-dictionary.md`、`reference/shang-wu-tong/reverse/swt-decompiled/sources/com/reception/app/business/heart/HeartBeat.java`、`reference/shang-wu-tong/reverse/swt-decompiled/sources/com/reception/app/business/sendfile/net/RenamedThread.java`；反编译客户端仅为线索，不替代服务器契约实测。
diff --git a/docs/product/07-design-auth-and-realtime.md b/docs/product/07-design-auth-and-realtime.md
index 31bba21b..1e71c1b9 100644
--- a/docs/product/07-design-auth-and-realtime.md
+++ b/docs/product/07-design-auth-and-realtime.md
@@ -11,7 +11,7 @@
 ### 1.1 对比 Chatwoot DeviseTokenAuth
 
 | 特性 | Chatwoot (Rails) | GoChat (Go) |
-|---|---|---|
+| --- | --- | --- |
 | 认证库 | DeviseTokenAuth gem | 自实现 JWT middleware |
 | Token存储 | 多token机制（client_id+token对） | 单JWT + Refresh token |
 | Token传递 | HTTP headers（access-token/client/uid） | Authorization: Bearer <jwt> |
@@ -85,6 +85,7 @@ func AuthMiddleware() gin.HandlerFunc {
 ```
 
 **认证级别分层：**
+
 - `PublicAPI` — 无认证（WebWidget嵌入、CSAT提交、Portal文章）
 - `AuthenticatedAPI` — AuthMiddleware（绝大多数API）
 - `AdminAPI` — AuthMiddleware + RoleCheck("administrator")（账户设置、团队管理等）
@@ -98,7 +99,7 @@ func AuthMiddleware() gin.HandlerFunc {
 ### 2.1 对比 Chatwoot Pundit + CustomRole
 
 | 特性 | Chatwoot | GoChat |
-|---|---|---|
+| --- | --- | --- |
 | 权限框架 | Pundit (Policy类) | 中间件+Policy函数 |
 | 内置角色 | agent / administrator | agent / administrator |
 | 自定义角色 | CustomRole (企业版, 6权限维度) | CustomRole (企业版, 同6维度) |
@@ -116,28 +117,23 @@ const (
 )
 
 // 企业版 CustomRole
+// 当前对外契约为六个二值权限：key 存在即拥有完整权限，未勾选即无权限。
 type CustomRole struct {
     ID          uint   `gorm:"primaryKey"`
     AccountID   uint   `gorm:"index"`
     Name        string `gorm:"size:255"`
-    Permissions Permissions `gorm:"type:jsonb"` // 6维度权限
+    Permissions []string `gorm:"type:jsonb"` // 6个二值权限 key
 }
 
-type Permissions struct {
-    ConversationManage  PermissionLevel `json:"conversation_manage"`    // full/read
-    ConversationDelete  PermissionLevel `json:"conversation_delete"`    // full/none
-    ContactManage       PermissionLevel `json:"contact_manage"`         // full/read
-    ReportManage        PermissionLevel `json:"report_manage"`          // full/none
-    KnowledgeBaseManage PermissionLevel `json:"knowledge_base_manage"`  // full/read
-    AutomationManage    PermissionLevel `json:"automation_manage"`      // full/none
-}
-
-type PermissionLevel string
-const (
-    PermissionFull PermissionLevel = "full"
-    PermissionRead PermissionLevel = "read"
-    PermissionNone PermissionLevel = "none"
-)
+// conversation_manage
+// conversation_unassigned_manage
+// conversation_participating_manage
+// contact_manage
+// report_manage
+// knowledge_base_manage
+//
+// PermissionLevel(full/read/none) 仅保留给内置角色和旧数据兼容层，
+// 不作为自定义角色前端/API 的配置粒度。
 ```
 
 ### 2.3 权限检查实现
@@ -230,7 +226,7 @@ type AccountUser struct {
 ### 4.1 对比 Chatwoot ActionCable
 
 | 特性 | Chatwoot (ActionCable) | GoChat (Redis Pub/Sub + WebSocket) |
-|---|---|---|
+| --- | --- | --- |
 | 连接管理 | ActionCable Server (Rails内置) | gorilla/websocket + Redis subscriber |
 | Channel订阅 | `ConversationChannel`, `AccountChannel` | Redis topic: `account:{id}`, `conversation:{id}` |
 | 消息推送 | `broadcast_to` | Redis PUBLISH → WebSocket send |
@@ -327,6 +323,7 @@ Dispatcher.dispatch(event_name, timestamp, event_data)
 ```
 
 **12个Listener：**
+
 - ActionCableListener → WebSocket推送
 - AgentBotListener → 触发Bot响应
 - AutomationRuleListener → 触发自动化规则
@@ -427,7 +424,7 @@ func StartConsumer(accountID uint) {
 ### 5.5 对比总结
 
 | 方面 | Chatwoot | GoChat |
-|---|---|---|
+| --- | --- | --- |
 | 事件发布 | Dispatcher → Redis PUBLISH | Dispatcher → Redis PUBLISH（相同） |
 | 事件消费 | 12个独立Listener类 | Handler函数注册表（更轻量） |
 | 执行方式 | Sidekiq异步Job | goroutine异步执行 |
@@ -441,6 +438,7 @@ func StartConsumer(accountID uint) {
 ### 6.1 对比 Chatwoot
 
 Chatwoot企业版SAML实现：
+
 - `AccountSamlSettings` 模型存储IdP配置
 - `DeviseSamlAuthenticatable` gem处理SAML流程
 - `SamlUserBuilder` 构建User对象
@@ -542,7 +540,7 @@ func (b *SamlUserBuilder) Build(samlResponse *SamlResponse) (*User, error) {
 ## 8. 关键设计决策总结
 
 | # | 决策 | 原因 | 对比Chatwoot |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | 1 | JWT替代DeviseTokenAuth | Go无对应gem，JWT更标准 | 多token→单token+refresh |
 | 2 | PolicyContext替代Pundit | 统一权限检查入口 | 12个Policy类→1个PolicyContext |
 | 3 | Handler注册表替代Listener类 | Go无Rails autoload，函数注册更轻量 | 12个Listener→Handler map |
@@ -554,4 +552,4 @@ func (b *SamlUserBuilder) Build(samlResponse *SamlResponse) (*User, error) {
 
 ---
 
-> **下一步:** P2B（数据库设计）和 P2C（路由设计）完成后，P2架构设计阶段完整收官。
\ No newline at end of file
+> **下一步:** P2B（数据库设计）和 P2C（路由设计）完成后，P2架构设计阶段完整收官。
diff --git a/frontend/app/javascript/dashboard/api/customRole.js b/frontend/app/javascript/dashboard/api/customRole.js
index 5074657d..fa4fd49c 100644
--- a/frontend/app/javascript/dashboard/api/customRole.js
+++ b/frontend/app/javascript/dashboard/api/customRole.js
@@ -4,6 +4,14 @@ class CustomRole extends ApiClient {
   constructor() {
     super('custom_roles', { accountScoped: true });
   }
+
+  create(data) {
+    return super.create({ custom_role: data });
+  }
+
+  update(id, data) {
+    return super.update(id, { custom_role: data });
+  }
 }
 
 export default new CustomRole();
diff --git a/frontend/app/javascript/dashboard/api/specs/customRole.spec.js b/frontend/app/javascript/dashboard/api/specs/customRole.spec.js
new file mode 100644
index 00000000..1c2f6439
--- /dev/null
+++ b/frontend/app/javascript/dashboard/api/specs/customRole.spec.js
@@ -0,0 +1,36 @@
+import customRole from '../customRole';
+
+describe('#CustomRoleAPI', () => {
+  const originalAxios = window.axios;
+  const axiosMock = {
+    post: vi.fn(() => Promise.resolve()),
+    patch: vi.fn(() => Promise.resolve()),
+  };
+
+  beforeEach(() => {
+    window.axios = axiosMock;
+  });
+
+  afterEach(() => {
+    window.axios = originalAxios;
+    vi.clearAllMocks();
+  });
+
+  it('wraps create and update payloads for the backend contract', () => {
+    const payload = {
+      name: 'Support',
+      description: 'Support role',
+      permissions: ['contact_manage'],
+    };
+
+    customRole.create(payload);
+    customRole.update(7, payload);
+
+    expect(axiosMock.post).toHaveBeenCalledWith('/api/v1/custom_roles', {
+      custom_role: payload,
+    });
+    expect(axiosMock.patch).toHaveBeenCalledWith('/api/v1/custom_roles/7', {
+      custom_role: payload,
+    });
+  });
+});
diff --git a/frontend/app/javascript/dashboard/components-next/sidebar/Sidebar.vue b/frontend/app/javascript/dashboard/components-next/sidebar/Sidebar.vue
index b17274b0..3eb268b1 100644
--- a/frontend/app/javascript/dashboard/components-next/sidebar/Sidebar.vue
+++ b/frontend/app/javascript/dashboard/components-next/sidebar/Sidebar.vue
@@ -23,17 +23,17 @@ import Logo from 'next/icon/Logo.vue';
 import ComposeConversation from 'dashboard/components-next/NewConversation/ComposeConversation.vue';
 
 const props = defineProps({
-	isMobileSidebarOpen: {
-		type: Boolean,
-		default: false,
-	},
+  isMobileSidebarOpen: {
+    type: Boolean,
+    default: false,
+  },
 });
 
 const emit = defineEmits([
-	'closeKeyShortcutModal',
-	'openKeyShortcutModal',
-	'showCreateAccountModal',
-	'closeMobileSidebar',
+  'closeKeyShortcutModal',
+  'openKeyShortcutModal',
+  'showCreateAccountModal',
+  'closeMobileSidebar',
 ]);
 
 const { accountScopedRoute, isOnChatwootCloud } = useAccount();
@@ -42,7 +42,7 @@ const searchShortcut = useKbd([`$mod`, 'k']);
 const { t } = useI18n();
 
 const isACustomBrandedInstance = useMapGetter(
-	'globalConfig/isACustomBrandedInstance'
+  'globalConfig/isACustomBrandedInstance'
 );
 const isRTL = useMapGetter('accounts/isRTL');
 
@@ -51,40 +51,40 @@ const isMobile = computed(() => windowWidth.value < 768);
 
 const accountId = useMapGetter('getCurrentAccountId');
 const isFeatureEnabledonAccount = useMapGetter(
-	'accounts/isFeatureEnabledonAccount'
+  'accounts/isFeatureEnabledonAccount'
 );
 
 const hasAssignmentV2 = computed(() => {
-	return isFeatureEnabledonAccount.value(
-		accountId.value,
-		FEATURE_FLAGS.ASSIGNMENT_V2
-	);
+  return isFeatureEnabledonAccount.value(
+    accountId.value,
+    FEATURE_FLAGS.ASSIGNMENT_V2
+  );
 });
 
 const hasConversationUnreadCounts = computed(() => {
-	return isFeatureEnabledonAccount.value(
-		accountId.value,
-		FEATURE_FLAGS.CONVERSATION_UNREAD_COUNTS
-	);
+  return isFeatureEnabledonAccount.value(
+    accountId.value,
+    FEATURE_FLAGS.CONVERSATION_UNREAD_COUNTS
+  );
 });
 
 const fetchConversationUnreadCounts = ([currentAccountId, isEnabled]) => {
-	if (!currentAccountId) return;
+  if (!currentAccountId) return;
 
-	if (!isEnabled) {
-		store.dispatch('conversationUnreadCounts/clear');
-		return;
-	}
+  if (!isEnabled) {
+    store.dispatch('conversationUnreadCounts/clear');
+    return;
+  }
 
-	store.dispatch('conversationUnreadCounts/get');
+  store.dispatch('conversationUnreadCounts/get');
 };
 
 const toggleShortcutModalFn = show => {
-	if (show) {
-		emit('openKeyShortcutModal');
-	} else {
-		emit('closeKeyShortcutModal');
-	}
+  if (show) {
+    emit('openKeyShortcutModal');
+  } else {
+    emit('closeKeyShortcutModal');
+  }
 };
 
 useSidebarKeyboardShortcuts(toggleShortcutModalFn);
@@ -92,22 +92,22 @@ useSidebarKeyboardShortcuts(toggleShortcutModalFn);
 const expandedItem = ref(null);
 
 const setExpandedItem = name => {
-	expandedItem.value = expandedItem.value === name ? null : name;
+  expandedItem.value = expandedItem.value === name ? null : name;
 };
 
 const {
-	sidebarWidth,
-	isCollapsed,
-	setSidebarWidth,
-	saveWidth,
-	snapToCollapsed,
-	snapToExpanded,
-	COLLAPSED_THRESHOLD,
+  sidebarWidth,
+  isCollapsed,
+  setSidebarWidth,
+  saveWidth,
+  snapToCollapsed,
+  snapToExpanded,
+  COLLAPSED_THRESHOLD,
 } = useSidebarResize();
 
 // On mobile, sidebar is always expanded (flyout mode)
 const isEffectivelyCollapsed = computed(
-	() => !isMobile.value && isCollapsed.value
+  () => !isMobile.value && isCollapsed.value
 );
 
 // Resize handle logic
@@ -116,55 +116,55 @@ const startX = ref(0);
 const startWidth = ref(0);
 
 provideSidebarContext({
-	expandedItem,
-	setExpandedItem,
-	isCollapsed: isEffectivelyCollapsed,
-	sidebarWidth,
-	isResizing,
+  expandedItem,
+  setExpandedItem,
+  isCollapsed: isEffectivelyCollapsed,
+  sidebarWidth,
+  isResizing,
 });
 
 // Get clientX from mouse or touch event
 const getClientX = event =>
-	event.touches ? event.touches[0].clientX : event.clientX;
+  event.touches ? event.touches[0].clientX : event.clientX;
 
 const onResizeStart = event => {
-	isResizing.value = true;
-	startX.value = getClientX(event);
-	startWidth.value = sidebarWidth.value;
-	Object.assign(document.body.style, {
-		cursor: 'col-resize',
-		userSelect: 'none',
-	});
-	// Prevent default to avoid scrolling on touch
-	event.preventDefault();
+  isResizing.value = true;
+  startX.value = getClientX(event);
+  startWidth.value = sidebarWidth.value;
+  Object.assign(document.body.style, {
+    cursor: 'col-resize',
+    userSelect: 'none',
+  });
+  // Prevent default to avoid scrolling on touch
+  event.preventDefault();
 };
 
 const onResizeMove = event => {
-	if (!isResizing.value) return;
+  if (!isResizing.value) return;
 
-	const delta = isRTL.value
-		? startX.value - getClientX(event)
-		: getClientX(event) - startX.value;
-	setSidebarWidth(startWidth.value + delta);
+  const delta = isRTL.value
+    ? startX.value - getClientX(event)
+    : getClientX(event) - startX.value;
+  setSidebarWidth(startWidth.value + delta);
 };
 
 const onResizeEnd = () => {
-	if (!isResizing.value) return;
+  if (!isResizing.value) return;
 
-	isResizing.value = false;
-	Object.assign(document.body.style, { cursor: '', userSelect: '' });
+  isResizing.value = false;
+  Object.assign(document.body.style, { cursor: '', userSelect: '' });
 
-	// Snap to collapsed state if below threshold
-	if (sidebarWidth.value < COLLAPSED_THRESHOLD) {
-		snapToCollapsed();
-	} else {
-		saveWidth();
-	}
+  // Snap to collapsed state if below threshold
+  if (sidebarWidth.value < COLLAPSED_THRESHOLD) {
+    snapToCollapsed();
+  } else {
+    saveWidth();
+  }
 };
 
 const onResizeHandleDoubleClick = () => {
-	if (isCollapsed.value) snapToExpanded();
-	else snapToCollapsed();
+  if (isCollapsed.value) snapToExpanded();
+  else snapToCollapsed();
 };
 
 // Support both mouse and touch events
@@ -176,803 +176,786 @@ useEventListener(document, 'touchend', onResizeEnd);
 const inboxes = useMapGetter('inboxes/getInboxes');
 const labels = useMapGetter('labels/getLabelsOnSidebar');
 const getInboxUnreadCount = useMapGetter(
-	'conversationUnreadCounts/getInboxUnreadCount'
+  'conversationUnreadCounts/getInboxUnreadCount'
 );
 const getLabelUnreadCount = useMapGetter(
-	'conversationUnreadCounts/getLabelUnreadCount'
+  'conversationUnreadCounts/getLabelUnreadCount'
 );
 const getTeamUnreadCount = useMapGetter(
-	'conversationUnreadCounts/getTeamUnreadCount'
+  'conversationUnreadCounts/getTeamUnreadCount'
 );
 const teams = useMapGetter('teams/getMyTeams');
 const contactCustomViews = useMapGetter('customViews/getContactCustomViews');
 const conversationCustomViews = useMapGetter(
-	'customViews/getConversationCustomViews'
+  'customViews/getConversationCustomViews'
 );
 
 onMounted(() => {
-	store.dispatch('labels/get');
-	store.dispatch('inboxes/get');
-	store.dispatch('notifications/unReadCount');
-	store.dispatch('teams/get');
-	store.dispatch('attributes/get');
-	store.dispatch('customViews/get', 'conversation');
-	store.dispatch('customViews/get', 'contact');
+  store.dispatch('labels/get');
+  store.dispatch('inboxes/get');
+  store.dispatch('notifications/unReadCount');
+  store.dispatch('teams/get');
+  store.dispatch('attributes/get');
+  store.dispatch('customViews/get', 'conversation');
+  store.dispatch('customViews/get', 'contact');
 });
 
 watch([accountId, hasConversationUnreadCounts], fetchConversationUnreadCounts, {
-	immediate: true,
+  immediate: true,
 });
 
 const normalizeUnreadCount = count => {
-	const unreadCount = Number(count);
-	return Number.isFinite(unreadCount) && unreadCount > 0 ? unreadCount : 0;
+  const unreadCount = Number(count);
+  return Number.isFinite(unreadCount) && unreadCount > 0 ? unreadCount : 0;
 };
 
 const sortByUnreadCount = (items, labelKey, unreadCountKey) =>
-	items.slice().sort((a, b) => {
-		const unreadCountDiff =
-			normalizeUnreadCount(unreadCountKey(b)) -
-			normalizeUnreadCount(unreadCountKey(a));
+  items.slice().sort((a, b) => {
+    const unreadCountDiff =
+      normalizeUnreadCount(unreadCountKey(b)) -
+      normalizeUnreadCount(unreadCountKey(a));
 
-		if (unreadCountDiff !== 0) return unreadCountDiff;
+    if (unreadCountDiff !== 0) return unreadCountDiff;
 
-		return labelKey(a).localeCompare(labelKey(b));
-	});
+    return labelKey(a).localeCompare(labelKey(b));
+  });
 
 const sortedTeams = computed(() =>
-	sortByUnreadCount(
-		teams.value,
-		team => team.name,
-		team => getTeamUnreadCount.value(team.id)
-	)
+  sortByUnreadCount(
+    teams.value,
+    team => team.name,
+    team => getTeamUnreadCount.value(team.id)
+  )
 );
 
 const sortedInboxes = computed(() =>
-	sortByUnreadCount(
-		inboxes.value,
-		inbox => inbox.name,
-		inbox => getInboxUnreadCount.value(inbox.id)
-	)
+  sortByUnreadCount(
+    inboxes.value,
+    inbox => inbox.name,
+    inbox => getInboxUnreadCount.value(inbox.id)
+  )
 );
 
 const sortedLabels = computed(() =>
-	sortByUnreadCount(
-		labels.value,
-		label => label.title,
-		label => getLabelUnreadCount.value(label.id)
-	)
+  sortByUnreadCount(
+    labels.value,
+    label => label.title,
+    label => getLabelUnreadCount.value(label.id)
+  )
 );
 
 const closeMobileSidebar = () => {
-	if (!props.isMobileSidebarOpen) return;
-	emit('closeMobileSidebar');
+  if (!props.isMobileSidebarOpen) return;
+  emit('closeMobileSidebar');
 };
 
 const newReportRoutes = () => [
-	{
-		name: 'Reports Agent',
-		label: t('SIDEBAR.REPORTS_AGENT'),
-		to: accountScopedRoute('agent_reports_index'),
-		activeOn: ['agent_reports_show'],
-	},
-	{
-		name: 'Reports Label',
-		label: t('SIDEBAR.REPORTS_LABEL'),
-		to: accountScopedRoute('label_reports_index'),
-	},
-	{
-		name: 'Reports Inbox',
-		label: t('SIDEBAR.REPORTS_INBOX'),
-		to: accountScopedRoute('inbox_reports_index'),
-		activeOn: ['inbox_reports_show'],
-	},
-	{
-		name: 'Reports Team',
-		label: t('SIDEBAR.REPORTS_TEAM'),
-		to: accountScopedRoute('team_reports_index'),
-		activeOn: ['team_reports_show'],
-	},
+  {
+    name: 'Reports Agent',
+    label: t('SIDEBAR.REPORTS_AGENT'),
+    to: accountScopedRoute('agent_reports_index'),
+    activeOn: ['agent_reports_show'],
+  },
+  {
+    name: 'Reports Label',
+    label: t('SIDEBAR.REPORTS_LABEL'),
+    to: accountScopedRoute('label_reports_index'),
+  },
+  {
+    name: 'Reports Inbox',
+    label: t('SIDEBAR.REPORTS_INBOX'),
+    to: accountScopedRoute('inbox_reports_index'),
+    activeOn: ['inbox_reports_show'],
+  },
+  {
+    name: 'Reports Team',
+    label: t('SIDEBAR.REPORTS_TEAM'),
+    to: accountScopedRoute('team_reports_index'),
+    activeOn: ['team_reports_show'],
+  },
 ];
 
 const reportRoutes = computed(() => newReportRoutes());
 
 const menuItems = computed(() => {
-	return [
-		{
-			name: 'Inbox',
-			label: t('SIDEBAR.INBOX'),
-			icon: 'i-lucide-inbox',
-			to: accountScopedRoute('inbox_view'),
-			activeOn: ['inbox_view', 'inbox_view_conversation'],
-			getterKeys: {
-				count: 'notifications/getUnreadCount',
-			},
-		},
-		{
-			name: 'Conversation',
-			label: t('SIDEBAR.CONVERSATIONS'),
-			icon: 'i-lucide-message-circle',
-			children: [
-				{
-					name: 'All',
-					label: t('SIDEBAR.ALL_CONVERSATIONS'),
-					activeOn: ['inbox_conversation'],
-					to: accountScopedRoute('home'),
-				},
-				{
-					name: 'Mentions',
-					label: t('SIDEBAR.MENTIONED_CONVERSATIONS'),
-					activeOn: ['conversation_through_mentions'],
-					to: accountScopedRoute('conversation_mentions'),
-				},
-				{
-					name: 'Participating',
-					label: t('SIDEBAR.PARTICIPATING_CONVERSATIONS'),
-					activeOn: ['conversation_through_participating'],
-					to: accountScopedRoute('conversation_participating'),
-				},
-				{
-					name: 'Unattended',
-					activeOn: ['conversation_through_unattended'],
-					label: t('SIDEBAR.UNATTENDED_CONVERSATIONS'),
-					to: accountScopedRoute('conversation_unattended'),
-				},
-				{
-					name: 'Folders',
-					label: t('SIDEBAR.CUSTOM_VIEWS_FOLDER'),
-					icon: 'i-lucide-folder',
-					activeOn: ['conversations_through_folders'],
-					children: conversationCustomViews.value.map(view => ({
-						name: `${view.name}-${view.id}`,
-						label: view.name,
-						to: accountScopedRoute('folder_conversations', {
-							id: view.id,
-						}),
-					})),
-				},
-				{
-					name: 'Teams',
-					label: t('SIDEBAR.TEAMS'),
-					icon: 'i-lucide-users',
-					activeOn: ['conversations_through_team'],
-					children: sortedTeams.value.map(team => ({
-						name: `${team.name}-${team.id}`,
-						label: team.name,
-						badgeCount: getTeamUnreadCount.value(team.id),
-						to: accountScopedRoute('team_conversations', {
-							teamId: team.id,
-						}),
-					})),
-				},
-				{
-					name: 'Channels',
-					label: t('SIDEBAR.CHANNELS'),
-					icon: 'i-lucide-mailbox',
-					activeOn: ['conversation_through_inbox'],
-					children: sortedInboxes.value.map(inbox => ({
-						name: `${inbox.name}-${inbox.id}`,
-						label: inbox.name,
-						badgeCount: getInboxUnreadCount.value(inbox.id),
-						icon: h(ChannelIcon, { inbox, class: 'size-[16px]' }),
-						to: accountScopedRoute('inbox_dashboard', {
-							inbox_id: inbox.id,
-						}),
-						component: leafProps =>
-							h(ChannelLeaf, {
-								label: leafProps.label,
-								active: leafProps.active,
-								inbox,
-								badgeCount: leafProps.badgeCount,
-							}),
-					})),
-				},
-				{
-					name: 'Labels',
-					label: t('SIDEBAR.LABELS'),
-					icon: 'i-lucide-tag',
-					activeOn: ['conversations_through_label'],
-					children: sortedLabels.value.map(label => ({
-						name: `${label.title}-${label.id}`,
-						label: label.title,
-						badgeCount: getLabelUnreadCount.value(label.id),
-						icon: h('span', {
-							class: `size-[8px] rounded-sm`,
-							style: { backgroundColor: label.color },
-						}),
-						to: accountScopedRoute('label_conversations', {
-							label: label.title,
-						}),
-					})),
-				},
-			],
-		},
-		{
-			name: 'Captain',
-			icon: 'i-woot-captain',
-			label: t('SIDEBAR.CAPTAIN'),
-			activeOn: ['captain_assistants_create_index'],
-			children: [
-				{
-					name: 'FAQs',
-					label: t('SIDEBAR.CAPTAIN_RESPONSES'),
-					activeOn: [
-						'captain_assistants_responses_index',
-						'captain_assistants_responses_pending',
-					],
-					to: accountScopedRoute('captain_assistants_index', {
-						navigationPath: 'captain_assistants_responses_index',
-					}),
-				},
-				{
-					name: 'Documents',
-					label: t('SIDEBAR.CAPTAIN_DOCUMENTS'),
-					activeOn: ['captain_assistants_documents_index'],
-					to: accountScopedRoute('captain_assistants_index', {
-						navigationPath: 'captain_assistants_documents_index',
-					}),
-				},
-				{
-					name: 'Scenarios',
-					label: t('SIDEBAR.CAPTAIN_SCENARIOS'),
-					activeOn: ['captain_assistants_scenarios_index'],
-					to: accountScopedRoute('captain_assistants_index', {
-						navigationPath: 'captain_assistants_scenarios_index',
-					}),
-				},
-				{
-					name: 'Skills',
-					label: t('SIDEBAR.CAPTAIN_SKILLS'),
-					activeOn: ['captain_assistants_skills_index'],
-					to: accountScopedRoute('captain_assistants_index', {
-						navigationPath: 'captain_assistants_skills_index',
-					}),
-				},
-				{
-					name: 'Playground',
-					label: t('SIDEBAR.CAPTAIN_PLAYGROUND'),
-					activeOn: ['captain_assistants_playground_index'],
-					to: accountScopedRoute('captain_assistants_index', {
-						navigationPath: 'captain_assistants_playground_index',
-					}),
-				},
-				{
-					name: 'Inboxes',
-					label: t('SIDEBAR.CAPTAIN_INBOXES'),
-					activeOn: ['captain_assistants_inboxes_index'],
-					to: accountScopedRoute('captain_assistants_index', {
-						navigationPath: 'captain_assistants_inboxes_index',
-					}),
-				},
-				{
-					name: 'Tools',
-					label: t('SIDEBAR.CAPTAIN_TOOLS'),
-					activeOn: ['captain_tools_index'],
-					to: accountScopedRoute('captain_assistants_index', {
-						navigationPath: 'captain_tools_index',
-					}),
-				},
-				{
-					name: 'Settings',
-					label: t('SIDEBAR.CAPTAIN_SETTINGS'),
-					activeOn: [
-						'captain_assistants_settings_index',
-						'captain_assistants_guidelines_index',
-						'captain_assistants_guardrails_index',
-					],
-					to: accountScopedRoute('captain_assistants_index', {
-						navigationPath: 'captain_assistants_settings_index',
-					}),
-				},
-			],
-		},
-		{
-			name: 'Contacts',
-			label: t('SIDEBAR.CONTACTS'),
-			icon: 'i-lucide-contact',
-			children: [
-				{
-					name: 'All Contacts',
-					label: t('SIDEBAR.ALL_CONTACTS'),
-					to: accountScopedRoute(
-						'contacts_dashboard_index',
-						{},
-						{ page: 1, search: undefined }
-					),
-					activeOn: ['contacts_dashboard_index', 'contacts_edit'],
-				},
-				{
-					name: 'Active',
-					label: t('SIDEBAR.ACTIVE'),
-					to: accountScopedRoute('contacts_dashboard_active'),
-					activeOn: ['contacts_dashboard_active'],
-				},
-				{
-					name: 'Segments',
-					icon: 'i-lucide-group',
-					label: t('SIDEBAR.CUSTOM_VIEWS_SEGMENTS'),
-					children: contactCustomViews.value.map(view => ({
-						name: `${view.name}-${view.id}`,
-						label: view.name,
-						to: accountScopedRoute(
-							'contacts_dashboard_segments_index',
-							{ segmentId: view.id },
-							{ page: 1 }
-						),
-						activeOn: [
-							'contacts_dashboard_segments_index',
-							'contacts_edit_segment',
-						],
-					})),
-				},
-				{
-					name: 'Tagged With',
-					icon: 'i-lucide-tag',
-					label: t('SIDEBAR.TAGGED_WITH'),
-					children: labels.value.map(label => ({
-						name: `${label.title}-${label.id}`,
-						label: label.title,
-						icon: h('span', {
-							class: `size-[8px] rounded-sm`,
-							style: { backgroundColor: label.color },
-						}),
-						to: accountScopedRoute(
-							'contacts_dashboard_labels_index',
-							{ label: label.title },
-							{ page: 1, search: undefined }
-						),
-						activeOn: [
-							'contacts_dashboard_labels_index',
-							'contacts_edit_label',
-						],
-					})),
-				},
-			],
-		},
-		{
-			name: 'Companies',
-			label: t('SIDEBAR.COMPANIES'),
-			icon: 'i-lucide-building-2',
-			children: [
-				{
-					name: 'All Companies',
-					label: t('SIDEBAR.ALL_COMPANIES'),
-					to: accountScopedRoute(
-						'companies_dashboard_index',
-						{},
-						{ page: 1, search: undefined }
-					),
-					activeOn: [
-						'companies_dashboard_index',
-						'companies_dashboard_show',
-					],
-				},
-			],
-		},
-		{
-			name: 'Reports',
-			label: t('SIDEBAR.REPORTS'),
-			icon: 'i-lucide-chart-spline',
-			children: [
-				{
-					name: 'Report Overview',
-					label: t('SIDEBAR.REPORTS_OVERVIEW'),
-					to: accountScopedRoute('account_overview_reports'),
-				},
-				{
-					name: 'Report Conversation',
-					label: t('SIDEBAR.REPORTS_CONVERSATION'),
-					to: accountScopedRoute('conversation_reports'),
-				},
-				...reportRoutes.value,
-				{
-					name: 'Reports CSAT',
-					label: t('SIDEBAR.CSAT'),
-					to: accountScopedRoute('csat_reports'),
-				},
-				{
-					name: 'Reports SLA',
-					label: t('SIDEBAR.REPORTS_SLA'),
-					to: accountScopedRoute('sla_reports'),
-				},
-				{
-					name: 'Reports Bot',
-					label: t('SIDEBAR.REPORTS_BOT'),
-					to: accountScopedRoute('bot_reports'),
-				},
-			],
-		},
-		{
-			name: 'Campaigns',
-			label: t('SIDEBAR.CAMPAIGNS'),
-			icon: 'i-lucide-megaphone',
-			children: [
-				{
-					name: 'Live chat',
-					label: t('SIDEBAR.LIVE_CHAT'),
-					to: accountScopedRoute('campaigns_livechat_index'),
-				},
-				{
-					name: 'SMS',
-					label: t('SIDEBAR.SMS'),
-					to: accountScopedRoute('campaigns_sms_index'),
-				},
-				{
-					name: 'WhatsApp',
-					label: t('SIDEBAR.WHATSAPP'),
-					to: accountScopedRoute('campaigns_whatsapp_index'),
-				},
-			],
-		},
-		{
-			name: 'Portals',
-			label: t('SIDEBAR.HELP_CENTER.TITLE'),
-			icon: 'i-lucide-library-big',
-			children: [
-				{
-					name: 'Articles',
-					label: t('SIDEBAR.HELP_CENTER.ARTICLES'),
-					activeOn: [
-						'portals_articles_index',
-						'portals_articles_new',
-						'portals_articles_edit',
-					],
-					to: accountScopedRoute('portals_index', {
-						navigationPath: 'portals_articles_index',
-					}),
-				},
-				{
-					name: 'Categories',
-					label: t('SIDEBAR.HELP_CENTER.CATEGORIES'),
-					activeOn: [
-						'portals_categories_index',
-						'portals_categories_articles_index',
-						'portals_categories_articles_edit',
-					],
-					to: accountScopedRoute('portals_index', {
-						navigationPath: 'portals_categories_index',
-					}),
-				},
-				{
-					name: 'Locales',
-					label: t('SIDEBAR.HELP_CENTER.LOCALES'),
-					activeOn: ['portals_locales_index'],
-					to: accountScopedRoute('portals_index', {
-						navigationPath: 'portals_locales_index',
-					}),
-				},
-				{
-					name: 'Settings',
-					label: t('SIDEBAR.HELP_CENTER.SETTINGS'),
-					activeOn: ['portals_settings_index'],
-					to: accountScopedRoute('portals_index', {
-						navigationPath: 'portals_settings_index',
-					}),
-				},
-			],
-		},
-		{
-			name: 'Settings',
-			label: t('SIDEBAR.SETTINGS'),
-			icon: 'i-lucide-bolt',
-			children: [
-				{
-					name: 'Settings Account Settings',
-					label: t('SIDEBAR.ACCOUNT_SETTINGS'),
-					icon: 'i-lucide-briefcase',
-					to: accountScopedRoute('general_settings_index'),
-				},
-				{
-					name: 'Settings Copilot',
-					label: t('SIDEBAR.CAPTAIN_AI'),
-					icon: 'i-woot-captain',
-					to: accountScopedRoute('copilot_settings_index'),
-				},
-				{
-					name: 'Settings Agents',
-					label: t('SIDEBAR.AGENTS'),
-					icon: 'i-lucide-square-user',
-					to: accountScopedRoute('agent_list'),
-				},
-				{
-					name: 'Settings Teams',
-					label: t('SIDEBAR.TEAMS'),
-					icon: 'i-lucide-users',
-					activeOn: [
-						'settings_teams_list',
-						'settings_teams_new',
-						'settings_teams_finish',
-						'settings_teams_add_agents',
-						'settings_teams_show',
-						'settings_teams_edit',
-						'settings_teams_edit_members',
-						'settings_teams_edit_finish',
-					],
-					to: accountScopedRoute('settings_teams_list'),
-				},
-				...(hasAssignmentV2.value
-					? [
-							{
-								name: 'Settings Agent Assignment',
-								label: t('SIDEBAR.AGENT_ASSIGNMENT'),
-								icon: 'i-lucide-user-cog',
-								activeOn: [
-									'assignment_policy_index',
-									'agent_assignment_policy_index',
-									'agent_assignment_policy_create',
-									'agent_assignment_policy_edit',
-									'agent_capacity_policy_index',
-									'agent_capacity_policy_create',
-									'agent_capacity_policy_edit',
-								],
-								to: accountScopedRoute(
-									'assignment_policy_index'
-								),
-							},
-						]
-					: []),
-				{
-					name: 'Settings Inboxes',
-					label: t('SIDEBAR.INBOXES'),
-					icon: 'i-lucide-inbox',
-					activeOn: [
-						'settings_inbox_list',
-						'settings_inbox_show',
-						'settings_inbox_new',
-						'settings_inbox_finish',
-						'settings_inboxes_page_channel',
-						'settings_inboxes_add_agents',
-					],
-					to: accountScopedRoute('settings_inbox_list'),
-				},
-				{
-					name: 'Settings Labels',
-					label: t('SIDEBAR.LABELS'),
-					icon: 'i-lucide-tags',
-					to: accountScopedRoute('labels_list'),
-				},
-				{
-					name: 'Settings Custom Attributes',
-					label: t('SIDEBAR.CUSTOM_ATTRIBUTES'),
-					icon: 'i-lucide-code',
-					to: accountScopedRoute('attributes_list'),
-				},
-				{
-					name: 'Settings Automation',
-					label: t('SIDEBAR.AUTOMATION'),
-					icon: 'i-lucide-repeat',
-					to: accountScopedRoute('automation_list'),
-				},
-				{
-					name: 'Settings Agent Bots',
-					label: t('SIDEBAR.AGENT_BOTS'),
-					icon: 'i-lucide-bot',
-					to: accountScopedRoute('agent_bots'),
-				},
-				{
-					name: 'Settings Macros',
-					label: t('SIDEBAR.MACROS'),
-					icon: 'i-lucide-toy-brick',
-					to: accountScopedRoute('macros_wrapper'),
-				},
-				{
-					name: 'Settings Canned Responses',
-					label: t('SIDEBAR.CANNED_RESPONSES'),
-					icon: 'i-lucide-message-square-quote',
-					to: accountScopedRoute('canned_list'),
-				},
-				{
-					name: 'Settings Integrations',
-					label: t('SIDEBAR.INTEGRATIONS'),
-					icon: 'i-lucide-blocks',
-					to: accountScopedRoute('settings_applications'),
-				},
-				{
-					name: 'Settings Audit Logs',
-					label: t('SIDEBAR.AUDIT_LOGS'),
-					icon: 'i-lucide-briefcase',
-					to: accountScopedRoute('auditlogs_list'),
-				},
-				{
-					name: 'Settings Custom Roles',
-					label: t('SIDEBAR.CUSTOM_ROLES'),
-					icon: 'i-lucide-shield-plus',
-					to: accountScopedRoute('custom_roles_list'),
-				},
-				{
-					name: 'Settings Sla',
-					label: t('SIDEBAR.SLA'),
-					icon: 'i-lucide-clock-alert',
-					to: accountScopedRoute('sla_list'),
-				},
-				{
-					name: 'Conversation Workflow',
-					label: t('SIDEBAR.CONVERSATION_WORKFLOW'),
-					icon: 'i-lucide-workflow',
-					to: accountScopedRoute('conversation_workflow_index'),
-				},
-				{
-					name: 'Settings Billing',
-					label: t('SIDEBAR.BILLING'),
-					icon: 'i-lucide-credit-card',
-					to: accountScopedRoute('billing_settings_index'),
-				},
-			],
-		},
-	];
+  return [
+    {
+      name: 'Inbox',
+      label: t('SIDEBAR.INBOX'),
+      icon: 'i-lucide-inbox',
+      to: accountScopedRoute('inbox_view'),
+      activeOn: ['inbox_view', 'inbox_view_conversation'],
+      getterKeys: {
+        count: 'notifications/getUnreadCount',
+      },
+    },
+    {
+      name: 'Conversation',
+      label: t('SIDEBAR.CONVERSATIONS'),
+      icon: 'i-lucide-message-circle',
+      children: [
+        {
+          name: 'All',
+          label: t('SIDEBAR.ALL_CONVERSATIONS'),
+          activeOn: ['inbox_conversation'],
+          to: accountScopedRoute('home'),
+        },
+        {
+          name: 'Mentions',
+          label: t('SIDEBAR.MENTIONED_CONVERSATIONS'),
+          activeOn: ['conversation_through_mentions'],
+          to: accountScopedRoute('conversation_mentions'),
+        },
+        {
+          name: 'Participating',
+          label: t('SIDEBAR.PARTICIPATING_CONVERSATIONS'),
+          activeOn: ['conversation_through_participating'],
+          to: accountScopedRoute('conversation_participating'),
+        },
+        {
+          name: 'Unattended',
+          activeOn: ['conversation_through_unattended'],
+          label: t('SIDEBAR.UNATTENDED_CONVERSATIONS'),
+          to: accountScopedRoute('conversation_unattended'),
+        },
+        {
+          name: 'Folders',
+          label: t('SIDEBAR.CUSTOM_VIEWS_FOLDER'),
+          icon: 'i-lucide-folder',
+          activeOn: ['conversations_through_folders'],
+          children: conversationCustomViews.value.map(view => ({
+            name: `${view.name}-${view.id}`,
+            label: view.name,
+            to: accountScopedRoute('folder_conversations', {
+              id: view.id,
+            }),
+          })),
+        },
+        {
+          name: 'Teams',
+          label: t('SIDEBAR.TEAMS'),
+          icon: 'i-lucide-users',
+          activeOn: ['conversations_through_team'],
+          children: sortedTeams.value.map(team => ({
+            name: `${team.name}-${team.id}`,
+            label: team.name,
+            badgeCount: getTeamUnreadCount.value(team.id),
+            to: accountScopedRoute('team_conversations', {
+              teamId: team.id,
+            }),
+          })),
+        },
+        {
+          name: 'Channels',
+          label: t('SIDEBAR.CHANNELS'),
+          icon: 'i-lucide-mailbox',
+          activeOn: ['conversation_through_inbox'],
+          children: sortedInboxes.value.map(inbox => ({
+            name: `${inbox.name}-${inbox.id}`,
+            label: inbox.name,
+            badgeCount: getInboxUnreadCount.value(inbox.id),
+            icon: h(ChannelIcon, { inbox, class: 'size-[16px]' }),
+            to: accountScopedRoute('inbox_dashboard', {
+              inbox_id: inbox.id,
+            }),
+            component: leafProps =>
+              h(ChannelLeaf, {
+                label: leafProps.label,
+                active: leafProps.active,
+                inbox,
+                badgeCount: leafProps.badgeCount,
+              }),
+          })),
+        },
+        {
+          name: 'Labels',
+          label: t('SIDEBAR.LABELS'),
+          icon: 'i-lucide-tag',
+          activeOn: ['conversations_through_label'],
+          children: sortedLabels.value.map(label => ({
+            name: `${label.title}-${label.id}`,
+            label: label.title,
+            badgeCount: getLabelUnreadCount.value(label.id),
+            icon: h('span', {
+              class: `size-[8px] rounded-sm`,
+              style: { backgroundColor: label.color },
+            }),
+            to: accountScopedRoute('label_conversations', {
+              label: label.title,
+            }),
+          })),
+        },
+      ],
+    },
+    {
+      name: 'Captain',
+      icon: 'i-woot-captain',
+      label: t('SIDEBAR.CAPTAIN'),
+      activeOn: ['captain_assistants_create_index'],
+      children: [
+        {
+          name: 'FAQs',
+          label: t('SIDEBAR.CAPTAIN_RESPONSES'),
+          activeOn: [
+            'captain_assistants_responses_index',
+            'captain_assistants_responses_pending',
+          ],
+          to: accountScopedRoute('captain_assistants_index', {
+            navigationPath: 'captain_assistants_responses_index',
+          }),
+        },
+        {
+          name: 'Documents',
+          label: t('SIDEBAR.CAPTAIN_DOCUMENTS'),
+          activeOn: ['captain_assistants_documents_index'],
+          to: accountScopedRoute('captain_assistants_index', {
+            navigationPath: 'captain_assistants_documents_index',
+          }),
+        },
+        {
+          name: 'Scenarios',
+          label: t('SIDEBAR.CAPTAIN_SCENARIOS'),
+          activeOn: ['captain_assistants_scenarios_index'],
+          to: accountScopedRoute('captain_assistants_index', {
+            navigationPath: 'captain_assistants_scenarios_index',
+          }),
+        },
+        {
+          name: 'Skills',
+          label: t('SIDEBAR.CAPTAIN_SKILLS'),
+          activeOn: ['captain_assistants_skills_index'],
+          to: accountScopedRoute('captain_assistants_index', {
+            navigationPath: 'captain_assistants_skills_index',
+          }),
+        },
+        {
+          name: 'Playground',
+          label: t('SIDEBAR.CAPTAIN_PLAYGROUND'),
+          activeOn: ['captain_assistants_playground_index'],
+          to: accountScopedRoute('captain_assistants_index', {
+            navigationPath: 'captain_assistants_playground_index',
+          }),
+        },
+        {
+          name: 'Inboxes',
+          label: t('SIDEBAR.CAPTAIN_INBOXES'),
+          activeOn: ['captain_assistants_inboxes_index'],
+          to: accountScopedRoute('captain_assistants_index', {
+            navigationPath: 'captain_assistants_inboxes_index',
+          }),
+        },
+        {
+          name: 'Tools',
+          label: t('SIDEBAR.CAPTAIN_TOOLS'),
+          activeOn: ['captain_tools_index'],
+          to: accountScopedRoute('captain_assistants_index', {
+            navigationPath: 'captain_tools_index',
+          }),
+        },
+        {
+          name: 'Settings',
+          label: t('SIDEBAR.CAPTAIN_SETTINGS'),
+          activeOn: [
+            'captain_assistants_settings_index',
+            'captain_assistants_guidelines_index',
+            'captain_assistants_guardrails_index',
+          ],
+          to: accountScopedRoute('captain_assistants_index', {
+            navigationPath: 'captain_assistants_settings_index',
+          }),
+        },
+      ],
+    },
+    {
+      name: 'Contacts',
+      label: t('SIDEBAR.CONTACTS'),
+      icon: 'i-lucide-contact',
+      children: [
+        {
+          name: 'All Contacts',
+          label: t('SIDEBAR.ALL_CONTACTS'),
+          to: accountScopedRoute(
+            'contacts_dashboard_index',
+            {},
+            { page: 1, search: undefined }
+          ),
+          activeOn: ['contacts_dashboard_index', 'contacts_edit'],
+        },
+        {
+          name: 'Active',
+          label: t('SIDEBAR.ACTIVE'),
+          to: accountScopedRoute('contacts_dashboard_active'),
+          activeOn: ['contacts_dashboard_active'],
+        },
+        {
+          name: 'Segments',
+          icon: 'i-lucide-group',
+          label: t('SIDEBAR.CUSTOM_VIEWS_SEGMENTS'),
+          children: contactCustomViews.value.map(view => ({
+            name: `${view.name}-${view.id}`,
+            label: view.name,
+            to: accountScopedRoute(
+              'contacts_dashboard_segments_index',
+              { segmentId: view.id },
+              { page: 1 }
+            ),
+            activeOn: [
+              'contacts_dashboard_segments_index',
+              'contacts_edit_segment',
+            ],
+          })),
+        },
+        {
+          name: 'Tagged With',
+          icon: 'i-lucide-tag',
+          label: t('SIDEBAR.TAGGED_WITH'),
+          children: labels.value.map(label => ({
+            name: `${label.title}-${label.id}`,
+            label: label.title,
+            icon: h('span', {
+              class: `size-[8px] rounded-sm`,
+              style: { backgroundColor: label.color },
+            }),
+            to: accountScopedRoute(
+              'contacts_dashboard_labels_index',
+              { label: label.title },
+              { page: 1, search: undefined }
+            ),
+            activeOn: [
+              'contacts_dashboard_labels_index',
+              'contacts_edit_label',
+            ],
+          })),
+        },
+      ],
+    },
+    {
+      name: 'Companies',
+      label: t('SIDEBAR.COMPANIES'),
+      icon: 'i-lucide-building-2',
+      children: [
+        {
+          name: 'All Companies',
+          label: t('SIDEBAR.ALL_COMPANIES'),
+          to: accountScopedRoute(
+            'companies_dashboard_index',
+            {},
+            { page: 1, search: undefined }
+          ),
+          activeOn: ['companies_dashboard_index', 'companies_dashboard_show'],
+        },
+      ],
+    },
+    {
+      name: 'Reports',
+      label: t('SIDEBAR.REPORTS'),
+      icon: 'i-lucide-chart-spline',
+      children: [
+        {
+          name: 'Report Overview',
+          label: t('SIDEBAR.REPORTS_OVERVIEW'),
+          to: accountScopedRoute('account_overview_reports'),
+        },
+        {
+          name: 'Report Conversation',
+          label: t('SIDEBAR.REPORTS_CONVERSATION'),
+          to: accountScopedRoute('conversation_reports'),
+        },
+        ...reportRoutes.value,
+        {
+          name: 'Reports CSAT',
+          label: t('SIDEBAR.CSAT'),
+          to: accountScopedRoute('csat_reports'),
+        },
+        {
+          name: 'Reports SLA',
+          label: t('SIDEBAR.REPORTS_SLA'),
+          to: accountScopedRoute('sla_reports'),
+        },
+        {
+          name: 'Reports Bot',
+          label: t('SIDEBAR.REPORTS_BOT'),
+          to: accountScopedRoute('bot_reports'),
+        },
+      ],
+    },
+    {
+      name: 'Campaigns',
+      label: t('SIDEBAR.CAMPAIGNS'),
+      icon: 'i-lucide-megaphone',
+      children: [
+        {
+          name: 'Live chat',
+          label: t('SIDEBAR.LIVE_CHAT'),
+          to: accountScopedRoute('campaigns_livechat_index'),
+        },
+        {
+          name: 'SMS',
+          label: t('SIDEBAR.SMS'),
+          to: accountScopedRoute('campaigns_sms_index'),
+        },
+        {
+          name: 'WhatsApp',
+          label: t('SIDEBAR.WHATSAPP'),
+          to: accountScopedRoute('campaigns_whatsapp_index'),
+        },
+      ],
+    },
+    {
+      name: 'Portals',
+      label: t('SIDEBAR.HELP_CENTER.TITLE'),
+      icon: 'i-lucide-library-big',
+      children: [
+        {
+          name: 'Articles',
+          label: t('SIDEBAR.HELP_CENTER.ARTICLES'),
+          activeOn: [
+            'portals_articles_index',
+            'portals_articles_new',
+            'portals_articles_edit',
+          ],
+          to: accountScopedRoute('portals_index', {
+            navigationPath: 'portals_articles_index',
+          }),
+        },
+        {
+          name: 'Categories',
+          label: t('SIDEBAR.HELP_CENTER.CATEGORIES'),
+          activeOn: [
+            'portals_categories_index',
+            'portals_categories_articles_index',
+            'portals_categories_articles_edit',
+          ],
+          to: accountScopedRoute('portals_index', {
+            navigationPath: 'portals_categories_index',
+          }),
+        },
+        {
+          name: 'Locales',
+          label: t('SIDEBAR.HELP_CENTER.LOCALES'),
+          activeOn: ['portals_locales_index'],
+          to: accountScopedRoute('portals_index', {
+            navigationPath: 'portals_locales_index',
+          }),
+        },
+        {
+          name: 'Settings',
+          label: t('SIDEBAR.HELP_CENTER.SETTINGS'),
+          activeOn: ['portals_settings_index'],
+          to: accountScopedRoute('portals_index', {
+            navigationPath: 'portals_settings_index',
+          }),
+        },
+      ],
+    },
+    {
+      name: 'Settings',
+      label: t('SIDEBAR.SETTINGS'),
+      icon: 'i-lucide-bolt',
+      children: [
+        {
+          name: 'Settings Account Settings',
+          label: t('SIDEBAR.ACCOUNT_SETTINGS'),
+          icon: 'i-lucide-briefcase',
+          to: accountScopedRoute('general_settings_index'),
+        },
+        {
+          name: 'Settings Copilot',
+          label: t('SIDEBAR.CAPTAIN_AI'),
+          icon: 'i-woot-captain',
+          to: accountScopedRoute('copilot_settings_index'),
+        },
+        {
+          name: 'Settings Agents',
+          label: t('SIDEBAR.AGENTS'),
+          icon: 'i-lucide-square-user',
+          to: accountScopedRoute('agent_list'),
+        },
+        {
+          name: 'Settings Teams',
+          label: t('SIDEBAR.TEAMS'),
+          icon: 'i-lucide-users',
+          activeOn: [
+            'settings_teams_list',
+            'settings_teams_new',
+            'settings_teams_finish',
+            'settings_teams_add_agents',
+            'settings_teams_show',
+            'settings_teams_edit',
+            'settings_teams_edit_members',
+            'settings_teams_edit_finish',
+          ],
+          to: accountScopedRoute('settings_teams_list'),
+        },
+        ...(hasAssignmentV2.value
+          ? [
+              {
+                name: 'Settings Agent Assignment',
+                label: t('SIDEBAR.AGENT_ASSIGNMENT'),
+                icon: 'i-lucide-user-cog',
+                activeOn: [
+                  'assignment_policy_index',
+                  'agent_assignment_policy_index',
+                  'agent_assignment_policy_create',
+                  'agent_assignment_policy_edit',
+                  'agent_capacity_policy_index',
+                  'agent_capacity_policy_create',
+                  'agent_capacity_policy_edit',
+                ],
+                to: accountScopedRoute('assignment_policy_index'),
+              },
+            ]
+          : []),
+        {
+          name: 'Settings Inboxes',
+          label: t('SIDEBAR.INBOXES'),
+          icon: 'i-lucide-inbox',
+          activeOn: [
+            'settings_inbox_list',
+            'settings_inbox_show',
+            'settings_inbox_new',
+            'settings_inbox_finish',
+            'settings_inboxes_page_channel',
+            'settings_inboxes_add_agents',
+          ],
+          to: accountScopedRoute('settings_inbox_list'),
+        },
+        {
+          name: 'Settings Labels',
+          label: t('SIDEBAR.LABELS'),
+          icon: 'i-lucide-tags',
+          to: accountScopedRoute('labels_list'),
+        },
+        {
+          name: 'Settings Custom Attributes',
+          label: t('SIDEBAR.CUSTOM_ATTRIBUTES'),
+          icon: 'i-lucide-code',
+          to: accountScopedRoute('attributes_list'),
+        },
+        {
+          name: 'Settings Automation',
+          label: t('SIDEBAR.AUTOMATION'),
+          icon: 'i-lucide-repeat',
+          to: accountScopedRoute('automation_list'),
+        },
+        {
+          name: 'Settings Agent Bots',
+          label: t('SIDEBAR.AGENT_BOTS'),
+          icon: 'i-lucide-bot',
+          to: accountScopedRoute('agent_bots'),
+        },
+        {
+          name: 'Settings Macros',
+          label: t('SIDEBAR.MACROS'),
+          icon: 'i-lucide-toy-brick',
+          to: accountScopedRoute('macros_wrapper'),
+        },
+        {
+          name: 'Settings Canned Responses',
+          label: t('SIDEBAR.CANNED_RESPONSES'),
+          icon: 'i-lucide-message-square-quote',
+          to: accountScopedRoute('canned_list'),
+        },
+        {
+          name: 'Settings Integrations',
+          label: t('SIDEBAR.INTEGRATIONS'),
+          icon: 'i-lucide-blocks',
+          to: accountScopedRoute('settings_applications'),
+        },
+        {
+          name: 'Settings Audit Logs',
+          label: t('SIDEBAR.AUDIT_LOGS'),
+          icon: 'i-lucide-briefcase',
+          to: accountScopedRoute('auditlogs_list'),
+        },
+        {
+          name: 'Settings Custom Roles',
+          label: t('SIDEBAR.CUSTOM_ROLES'),
+          icon: 'i-lucide-shield-plus',
+          to: accountScopedRoute('custom_roles_list'),
+        },
+        {
+          name: 'Settings Sla',
+          label: t('SIDEBAR.SLA'),
+          icon: 'i-lucide-clock-alert',
+          to: accountScopedRoute('sla_list'),
+        },
+        {
+          name: 'Conversation Workflow',
+          label: t('SIDEBAR.CONVERSATION_WORKFLOW'),
+          icon: 'i-lucide-workflow',
+          to: accountScopedRoute('conversation_workflow_index'),
+        },
+        ...(isOnChatwootCloud.value && !isACustomBrandedInstance.value
+          ? [
+              {
+                name: 'Settings Billing',
+                label: t('SIDEBAR.BILLING'),
+                icon: 'i-lucide-credit-card',
+                to: accountScopedRoute('billing_settings_index'),
+              },
+            ]
+          : []),
+      ],
+    },
+  ];
 });
 </script>
 
 <template>
-	<aside
-		v-on-click-outside="[
-			closeMobileSidebar,
-			{
-				ignore: [
-					'#mobile-sidebar-launcher',
-					'[data-popover-content]',
-					'[data-popover-backdrop]',
-				],
-			},
-		]"
-		class="bg-n-background flex flex-col text-sm pb-px fixed top-0 ltr:left-0 rtl:right-0 h-full z-40 w-[200px] md:w-auto md:relative md:flex-shrink-0 md:ltr:translate-x-0 md:rtl:translate-x-0 ltr:border-r rtl:border-l border-n-weak"
-		:class="[
-			{
-				'shadow-lg md:shadow-none': isMobileSidebarOpen,
-				'ltr:-translate-x-full rtl:translate-x-full':
-					!isMobileSidebarOpen,
-				'transition-transform duration-200 ease-out md:transition-[width]':
-					!isResizing,
-			},
-		]"
-		:style="isMobile ? undefined : { width: `${sidebarWidth}px` }"
-	>
-		<section
-			class="grid"
-			:class="
-				isEffectivelyCollapsed ? 'mt-3 mb-6 gap-4' : 'mt-1 mb-4 gap-2'
-			"
-		>
-			<div
-				class="flex gap-2 items-center min-w-0"
-				:class="{
-					'justify-center px-1': isEffectivelyCollapsed,
-					'px-2': !isEffectivelyCollapsed,
-				}"
-			>
-				<template v-if="isEffectivelyCollapsed">
-					<SidebarAccountSwitcher
-						is-collapsed
-						@show-create-account-modal="
-							emit('showCreateAccountModal')
-						"
-					/>
-				</template>
-				<template v-else>
-					<div class="grid flex-shrink-0 place-content-center size-6">
-						<Logo class="size-4" />
-					</div>
-					<div class="flex-shrink-0 w-px h-3 bg-n-strong" />
-					<SidebarAccountSwitcher
-						class="flex-grow -mx-1 min-w-0"
-						@show-create-account-modal="
-							emit('showCreateAccountModal')
-						"
-					/>
-				</template>
-			</div>
-			<div
-				class="flex gap-2"
-				:class="
-					isEffectivelyCollapsed ? 'flex-col items-center' : 'px-2'
-				"
-			>
-				<RouterLink
-					v-if="!isEffectivelyCollapsed"
-					:to="{ name: 'search' }"
-					class="flex gap-2 items-center px-2 py-1 w-full h-7 rounded-lg outline outline-1 outline-n-weak bg-n-button-color transition-all duration-100 ease-out"
-				>
-					<span
-						class="flex-shrink-0 i-lucide-search size-4 text-n-slate-10"
-					/>
-					<span class="flex-grow text-start text-n-slate-10">
-						{{ t('COMBOBOX.SEARCH_PLACEHOLDER') }}
-					</span>
-					<span
-						class="hidden tracking-wide pointer-events-none select-none text-n-slate-10"
-					>
-						{{ searchShortcut }}
-					</span>
-				</RouterLink>
-				<RouterLink
-					v-else
-					:to="{ name: 'search' }"
-					class="flex items-center justify-center size-8 rounded-lg outline outline-1 outline-n-weak bg-n-button-color transition-all duration-100 ease-out hover:bg-n-alpha-2 dark:hover:bg-n-slate-9/30"
-					:title="t('COMBOBOX.SEARCH_PLACEHOLDER')"
-				>
-					<span class="i-lucide-search size-4 text-n-slate-11" />
-				</RouterLink>
-				<ComposeConversation align="start">
-					<template #trigger="{ isOpen }">
-						<Button
-							icon="i-lucide-pen-line"
-							color="slate"
-							size="sm"
-							class="dark:hover:!bg-n-slate-9/30"
-							:class="[
-								isEffectivelyCollapsed
-									? '!size-8 !outline-n-weak !text-n-slate-11'
-									: '!h-7 !outline-n-weak !text-n-slate-11',
-								{
-									'!bg-n-alpha-2 dark:!bg-n-slate-9/30':
-										isOpen,
-								},
-							]"
-						/>
-					</template>
-				</ComposeConversation>
-			</div>
-		</section>
-		<nav
-			class="grid overflow-y-scroll flex-grow gap-2 pb-5 no-scrollbar min-w-0"
-			:class="isEffectivelyCollapsed ? 'px-1' : 'px-2'"
-		>
-			<ul
-				class="flex flex-col gap-1 m-0 list-none min-w-0"
-				:class="{ 'items-center': isEffectivelyCollapsed }"
-			>
-				<SidebarGroup
-					v-for="item in menuItems"
-					:key="item.name"
-					v-bind="item"
-				/>
-			</ul>
-		</nav>
-		<section
-			class="flex relative flex-col flex-shrink-0 gap-1 justify-between items-center"
-		>
-			<div
-				class="pointer-events-none absolute inset-x-0 -top-[1.938rem] h-8 bg-gradient-to-t from-n-background to-transparent"
-			/>
-			<SidebarChangelogCard
-				v-if="
-					isOnChatwootCloud &&
-					!isACustomBrandedInstance &&
-					!isEffectivelyCollapsed
-				"
-			/>
-			<SidebarChangelogButton
-				v-if="
-					isOnChatwootCloud &&
-					!isACustomBrandedInstance &&
-					isEffectivelyCollapsed
-				"
-			/>
-			<div
-				class="px-1 py-1.5 flex-shrink-0 flex w-full z-50 gap-2 items-center border-t border-n-weak shadow-[0px_-2px_4px_0px_rgba(27,28,29,0.02)]"
-				:class="
-					isEffectivelyCollapsed
-						? 'justify-center'
-						: 'justify-between'
-				"
-			>
-				<SidebarProfileMenu
-					:is-collapsed="isEffectivelyCollapsed"
-					@open-key-shortcut-modal="emit('openKeyShortcutModal')"
-				/>
-			</div>
-		</section>
-		<!-- Resize Handle (desktop only) -->
-		<div
-			class="hidden md:block absolute top-0 h-full w-1 cursor-col-resize z-40 ltr:right-0 rtl:left-0 group"
-			@mousedown="onResizeStart"
-			@touchstart="onResizeStart"
-			@dblclick="onResizeHandleDoubleClick"
-		>
-			<div
-				class="absolute top-0 h-full w-px ltr:right-0 rtl:left-0 bg-transparent group-hover:bg-n-brand transition-colors"
-				:class="{ 'bg-n-brand': isResizing }"
-			/>
-		</div>
-	</aside>
+  <aside
+    v-on-click-outside="[
+      closeMobileSidebar,
+      {
+        ignore: [
+          '#mobile-sidebar-launcher',
+          '[data-popover-content]',
+          '[data-popover-backdrop]',
+        ],
+      },
+    ]"
+    class="bg-n-background flex flex-col text-sm pb-px fixed top-0 ltr:left-0 rtl:right-0 h-full z-40 w-[200px] md:w-auto md:relative md:flex-shrink-0 md:ltr:translate-x-0 md:rtl:translate-x-0 ltr:border-r rtl:border-l border-n-weak"
+    :class="[
+      {
+        'shadow-lg md:shadow-none': isMobileSidebarOpen,
+        'ltr:-translate-x-full rtl:translate-x-full': !isMobileSidebarOpen,
+        'transition-transform duration-200 ease-out md:transition-[width]':
+          !isResizing,
+      },
+    ]"
+    :style="isMobile ? undefined : { width: `${sidebarWidth}px` }"
+  >
+    <section
+      class="grid"
+      :class="isEffectivelyCollapsed ? 'mt-3 mb-6 gap-4' : 'mt-1 mb-4 gap-2'"
+    >
+      <div
+        class="flex gap-2 items-center min-w-0"
+        :class="{
+          'justify-center px-1': isEffectivelyCollapsed,
+          'px-2': !isEffectivelyCollapsed,
+        }"
+      >
+        <template v-if="isEffectivelyCollapsed">
+          <SidebarAccountSwitcher
+            is-collapsed
+            @show-create-account-modal="emit('showCreateAccountModal')"
+          />
+        </template>
+        <template v-else>
+          <div class="grid flex-shrink-0 place-content-center size-6">
+            <Logo class="size-4" />
+          </div>
+          <div class="flex-shrink-0 w-px h-3 bg-n-strong" />
+          <SidebarAccountSwitcher
+            class="flex-grow -mx-1 min-w-0"
+            @show-create-account-modal="emit('showCreateAccountModal')"
+          />
+        </template>
+      </div>
+      <div
+        class="flex gap-2"
+        :class="isEffectivelyCollapsed ? 'flex-col items-center' : 'px-2'"
+      >
+        <RouterLink
+          v-if="!isEffectivelyCollapsed"
+          :to="{ name: 'search' }"
+          class="flex gap-2 items-center px-2 py-1 w-full h-7 rounded-lg outline outline-1 outline-n-weak bg-n-button-color transition-all duration-100 ease-out"
+        >
+          <span class="flex-shrink-0 i-lucide-search size-4 text-n-slate-10" />
+          <span class="flex-grow text-start text-n-slate-10">
+            {{ t('COMBOBOX.SEARCH_PLACEHOLDER') }}
+          </span>
+          <span
+            class="hidden tracking-wide pointer-events-none select-none text-n-slate-10"
+          >
+            {{ searchShortcut }}
+          </span>
+        </RouterLink>
+        <RouterLink
+          v-else
+          :to="{ name: 'search' }"
+          class="flex items-center justify-center size-8 rounded-lg outline outline-1 outline-n-weak bg-n-button-color transition-all duration-100 ease-out hover:bg-n-alpha-2 dark:hover:bg-n-slate-9/30"
+          :title="t('COMBOBOX.SEARCH_PLACEHOLDER')"
+        >
+          <span class="i-lucide-search size-4 text-n-slate-11" />
+        </RouterLink>
+        <ComposeConversation align="start">
+          <template #trigger="{ isOpen }">
+            <Button
+              icon="i-lucide-pen-line"
+              color="slate"
+              size="sm"
+              class="dark:hover:!bg-n-slate-9/30"
+              :class="[
+                isEffectivelyCollapsed
+                  ? '!size-8 !outline-n-weak !text-n-slate-11'
+                  : '!h-7 !outline-n-weak !text-n-slate-11',
+                {
+                  '!bg-n-alpha-2 dark:!bg-n-slate-9/30': isOpen,
+                },
+              ]"
+            />
+          </template>
+        </ComposeConversation>
+      </div>
+    </section>
+    <nav
+      class="grid overflow-y-scroll flex-grow gap-2 pb-5 no-scrollbar min-w-0"
+      :class="isEffectivelyCollapsed ? 'px-1' : 'px-2'"
+    >
+      <ul
+        class="flex flex-col gap-1 m-0 list-none min-w-0"
+        :class="{ 'items-center': isEffectivelyCollapsed }"
+      >
+        <SidebarGroup
+          v-for="item in menuItems"
+          :key="item.name"
+          v-bind="item"
+        />
+      </ul>
+    </nav>
+    <section
+      class="flex relative flex-col flex-shrink-0 gap-1 justify-between items-center"
+    >
+      <div
+        class="pointer-events-none absolute inset-x-0 -top-[1.938rem] h-8 bg-gradient-to-t from-n-background to-transparent"
+      />
+      <SidebarChangelogCard
+        v-if="
+          isOnChatwootCloud &&
+          !isACustomBrandedInstance &&
+          !isEffectivelyCollapsed
+        "
+      />
+      <SidebarChangelogButton
+        v-if="
+          isOnChatwootCloud &&
+          !isACustomBrandedInstance &&
+          isEffectivelyCollapsed
+        "
+      />
+      <div
+        class="px-1 py-1.5 flex-shrink-0 flex w-full z-50 gap-2 items-center border-t border-n-weak shadow-[0px_-2px_4px_0px_rgba(27,28,29,0.02)]"
+        :class="isEffectivelyCollapsed ? 'justify-center' : 'justify-between'"
+      >
+        <SidebarProfileMenu
+          :is-collapsed="isEffectivelyCollapsed"
+          @open-key-shortcut-modal="emit('openKeyShortcutModal')"
+        />
+      </div>
+    </section>
+    <!-- Resize Handle (desktop only) -->
+    <div
+      class="hidden md:block absolute top-0 h-full w-1 cursor-col-resize z-40 ltr:right-0 rtl:left-0 group"
+      @mousedown="onResizeStart"
+      @touchstart="onResizeStart"
+      @dblclick="onResizeHandleDoubleClick"
+    >
+      <div
+        class="absolute top-0 h-full w-px ltr:right-0 rtl:left-0 bg-transparent group-hover:bg-n-brand transition-colors"
+        :class="{ 'bg-n-brand': isResizing }"
+      />
+    </div>
+  </aside>
 </template>
diff --git a/frontend/app/javascript/dashboard/components-next/sidebar/provider.js b/frontend/app/javascript/dashboard/components-next/sidebar/provider.js
index dc844201..768e7f7f 100644
--- a/frontend/app/javascript/dashboard/components-next/sidebar/provider.js
+++ b/frontend/app/javascript/dashboard/components-next/sidebar/provider.js
@@ -126,24 +126,10 @@ export function useSidebarContext() {
     return router.resolve(to)?.meta?.featureFlag || '';
   };
 
-  const resolveInstallationType = to => {
-    if (!to) return [];
-
-    // If navigationPath param exists, get the target route definition
-    if (to.params?.navigationPath) {
-      const targetRoute = findRouteByName(to.params.navigationPath);
-      return targetRoute?.meta?.installationTypes || [];
-    }
-
-    return router.resolve(to)?.meta?.installationTypes || [];
-  };
-
   const isAllowed = to => {
     const permissions = resolvePermissions(to);
     const featureFlag = resolveFeatureFlag(to);
-    const installationType = resolveInstallationType(to);
-
-    return shouldShow(featureFlag, permissions, installationType);
+    return shouldShow(featureFlag, permissions);
   };
 
   return {
diff --git a/frontend/app/javascript/dashboard/components/policy.vue b/frontend/app/javascript/dashboard/components/policy.vue
index 5e0aa9d5..6dcabb1e 100644
--- a/frontend/app/javascript/dashboard/components/policy.vue
+++ b/frontend/app/javascript/dashboard/components/policy.vue
@@ -15,17 +15,11 @@ const props = defineProps({
     type: String,
     default: null,
   },
-  installationTypes: {
-    type: Array,
-    default: null,
-  },
 });
 
 const { shouldShow } = usePolicy();
 
-const show = computed(() =>
-  shouldShow(props.featureFlag, props.permissions, props.installationTypes)
-);
+const show = computed(() => shouldShow(props.featureFlag, props.permissions));
 </script>
 
 <!-- eslint-disable vue/no-root-v-if -->
diff --git a/frontend/app/javascript/dashboard/composables/usePolicy.js b/frontend/app/javascript/dashboard/composables/usePolicy.js
index a8380aeb..69a70274 100644
--- a/frontend/app/javascript/dashboard/composables/usePolicy.js
+++ b/frontend/app/javascript/dashboard/composables/usePolicy.js
@@ -7,8 +7,6 @@ import {
 } from 'dashboard/helper/permissionsHelper';
 import { PREMIUM_FEATURES } from 'dashboard/featureFlags';
 
-import { INSTALLATION_TYPES } from 'dashboard/constants/installationTypes';
-
 export function usePolicy() {
   const user = useMapGetter('getCurrentUser');
   const isFeatureEnabled = useMapGetter('accounts/isFeatureEnabledonAccount');
@@ -34,35 +32,17 @@ export function usePolicy() {
     return hasPermissions(requiredPermissions, userPermissions);
   };
 
-  const checkInstallationType = config => {
-    if (Array.isArray(config) && config.length > 0) {
-      const installationCheck = {
-        [INSTALLATION_TYPES.ENTERPRISE]: true,
-        [INSTALLATION_TYPES.CLOUD]: isOnChatwootCloud.value,
-        [INSTALLATION_TYPES.COMMUNITY]: true,
-      };
-
-      return config.some(type => installationCheck[type]);
-    }
-
-    return true;
-  };
-
   const isPremiumFeature = featureFlag => {
     if (!featureFlag) return true;
     return PREMIUM_FEATURES.includes(featureFlag);
   };
 
-  const shouldShow = (featureFlag, permissions, installationTypes) => {
+  const shouldShow = (featureFlag, permissions) => {
     const flag = unref(featureFlag);
     const perms = unref(permissions);
-    const installation = unref(installationTypes);
 
-    // if the user does not have permissions or installation type is not supported
-    // return false;
-    // This supersedes everything
+    // Permissions supersede feature visibility.
     if (!checkPermissions(perms)) return false;
-    if (!checkInstallationType(installation)) return false;
 
     if (isACustomBrandedInstance.value) {
       // if this is a custom branded instance, we just use the feature flag as a reference
@@ -76,8 +56,9 @@ export function usePolicy() {
       return isFeatureFlagEnabled(flag) || isPremiumFeature(flag);
     }
 
-    // default to true
-    return true;
+    // Premium routes remain visible so their page can render its paywall;
+    // other routes still honor the account feature flag on self-hosted installs.
+    return isFeatureFlagEnabled(flag) || isPremiumFeature(flag);
   };
 
   const shouldShowPaywall = featureFlag => {
@@ -89,7 +70,7 @@ export function usePolicy() {
       return false;
     }
 
-    if (isPremiumFeature(flag) && isOnChatwootCloud.value) {
+    if (isPremiumFeature(flag)) {
       return !isFeatureFlagEnabled(flag);
     }
 
diff --git a/frontend/app/javascript/dashboard/constants/installationTypes.js b/frontend/app/javascript/dashboard/constants/installationTypes.js
deleted file mode 100644
index 87709e98..00000000
--- a/frontend/app/javascript/dashboard/constants/installationTypes.js
+++ /dev/null
@@ -1,5 +0,0 @@
-export const INSTALLATION_TYPES = {
-  CLOUD: 'cloud',
-  ENTERPRISE: 'enterprise',
-  COMMUNITY: 'community',
-};
diff --git a/frontend/app/javascript/dashboard/helper/routeHelpers.js b/frontend/app/javascript/dashboard/helper/routeHelpers.js
index 292e5e6e..38cabcae 100644
--- a/frontend/app/javascript/dashboard/helper/routeHelpers.js
+++ b/frontend/app/javascript/dashboard/helper/routeHelpers.js
@@ -5,12 +5,12 @@ import {
 } from './permissionsHelper';
 
 import {
-  ROLES,
   CONVERSATION_PERMISSIONS,
   CONTACT_PERMISSIONS,
   REPORTS_PERMISSIONS,
   PORTAL_PERMISSIONS,
 } from 'dashboard/constants/permissions.js';
+import { isSuperAdminUser } from '../routes/dashboard/settings/captain/utils';
 
 export const routeIsAccessibleFor = (route, userPermissions = []) => {
   const { meta: { permissions: routePermissions = [] } = {} } = route;
@@ -22,7 +22,7 @@ export const defaultRedirectPage = (to, permissions) => {
 
   const permissionRoutes = [
     {
-      permissions: [...ROLES, ...CONVERSATION_PERMISSIONS],
+      permissions: CONVERSATION_PERMISSIONS,
       path: 'dashboard',
     },
     { permissions: [CONTACT_PERMISSIONS], path: 'contacts' },
@@ -34,7 +34,11 @@ export const defaultRedirectPage = (to, permissions) => {
     hasPermissions(routePermissions, permissions)
   );
 
-  return `accounts/${accountId}/${route ? route.path : 'dashboard'}`;
+  if (route) return `accounts/${accountId}/${route.path}`;
+  if (permissions.includes('custom_role')) {
+    return `accounts/${accountId}/profile/settings`;
+  }
+  return `accounts/${accountId}/dashboard`;
 };
 
 const validateActiveAccountRoutes = (to, user) => {
@@ -48,6 +52,10 @@ const validateActiveAccountRoutes = (to, user) => {
 
   const userPermissions = getUserPermissions(user, to.params.accountId);
 
+  if (to.meta?.isSuperAdmin && !isSuperAdminUser(user)) {
+    return defaultRedirectPage(to, userPermissions);
+  }
+
   const isAccessible = routeIsAccessibleFor(to, userPermissions);
   // If the route is not accessible for the user, return to dashboard screen
   return isAccessible ? null : defaultRedirectPage(to, userPermissions);
diff --git a/frontend/app/javascript/dashboard/helper/specs/routeHelpers.spec.js b/frontend/app/javascript/dashboard/helper/specs/routeHelpers.spec.js
index 6370a9a9..d125c8eb 100644
--- a/frontend/app/javascript/dashboard/helper/specs/routeHelpers.spec.js
+++ b/frontend/app/javascript/dashboard/helper/specs/routeHelpers.spec.js
@@ -55,9 +55,11 @@ describe('#defaultRedirectPage', () => {
     expect(defaultRedirectPage(to, permissions)).toBe('accounts/2/portals');
   });
 
-  it('should return dashboard route as default for users with custom roles', () => {
+  it('should return the profile route for zero-permission custom roles', () => {
     const permissions = ['custom_role'];
-    expect(defaultRedirectPage(to, permissions)).toBe('accounts/2/dashboard');
+    expect(defaultRedirectPage(to, permissions)).toBe(
+      'accounts/2/profile/settings'
+    );
   });
 
   it('should return dashboard route for users with administrator role', () => {
@@ -138,6 +140,28 @@ describe('#validateLoggedInRoutes', () => {
             )
           ).toEqual(`accounts/1/dashboard`);
         });
+
+        it('redirects non-super-admin users from super-admin routes', () => {
+          expect(
+            validateLoggedInRoutes(
+              {
+                name: 'super_admin_dashboard',
+                params: { accountId: 1 },
+                meta: { isSuperAdmin: true, permissions: ['agent'] },
+              },
+              {
+                accounts: [
+                  {
+                    id: 1,
+                    role: 'agent',
+                    permissions: ['agent'],
+                    status: 'active',
+                  },
+                ],
+              }
+            )
+          ).toEqual(`accounts/1/dashboard`);
+        });
       });
       describe('when route is suspended route', () => {
         it('returns dashboard url', () => {
diff --git a/frontend/app/javascript/dashboard/i18n/locale/en/customRole.json b/frontend/app/javascript/dashboard/i18n/locale/en/customRole.json
index f7c1709b..62790fc4 100644
--- a/frontend/app/javascript/dashboard/i18n/locale/en/customRole.json
+++ b/frontend/app/javascript/dashboard/i18n/locale/en/customRole.json
@@ -23,6 +23,8 @@
     },
     "LIST": {
       "404": "There are no custom roles available in this account.",
+      "ERROR": "Unable to load custom roles. Please try again.",
+      "RETRY": "Retry",
       "TITLE": "Manage custom roles",
       "DESC": "Custom roles are roles that are created by the account owner or admin. These roles can be assigned to agents to define their access and permissions within the account. Custom roles can be created with specific permissions and access levels to suit the requirements of the organization.",
       "TABLE_HEADER": {
@@ -85,9 +87,9 @@
       },
       "CONFIRM": {
         "TITLE": "Confirm deletion",
-        "MESSAGE": "Are you sure to delete ",
-        "YES": "Yes, delete ",
-        "NO": "No, keep "
+        "MESSAGE": "Deleting this role removes it from all assigned agents and restores standard Agent permissions; some permissions may increase. Continue?",
+        "YES": "Yes, delete",
+        "NO": "No, keep"
       }
     }
   }
diff --git a/frontend/app/javascript/dashboard/i18n/locale/zh_CN/customRole.json b/frontend/app/javascript/dashboard/i18n/locale/zh_CN/customRole.json
index 712483bc..f7eb0c86 100644
--- a/frontend/app/javascript/dashboard/i18n/locale/zh_CN/customRole.json
+++ b/frontend/app/javascript/dashboard/i18n/locale/zh_CN/customRole.json
@@ -23,6 +23,8 @@
     },
     "LIST": {
       "404": "此账户中没有可用的自定义角色。",
+      "ERROR": "自定义角色加载失败，请重试。",
+      "RETRY": "重试",
       "TITLE": "管理自定义角色",
       "DESC": "自定义角色是由账户所有者或管理员创建的角色。这些角色可以分配给客服人员，以定义他们在账户中的访问权限和权限。自定义角色可以根据组织的需求创建特定的权限和访问级别。",
       "TABLE_HEADER": {
@@ -85,7 +87,7 @@
       },
       "CONFIRM": {
         "TITLE": "确认删除",
-        "MESSAGE": "您确定要删除吗 ",
+        "MESSAGE": "删除此角色后，所有使用该角色的客服将改用普通客服权限，部分权限可能增加。是否继续？",
         "YES": "是的，删除",
         "NO": "不，保留"
       }
diff --git a/frontend/app/javascript/dashboard/modules/search/components/SearchHeader.vue b/frontend/app/javascript/dashboard/modules/search/components/SearchHeader.vue
index 08d4c0c7..7a6f6bc1 100644
--- a/frontend/app/javascript/dashboard/modules/search/components/SearchHeader.vue
+++ b/frontend/app/javascript/dashboard/modules/search/components/SearchHeader.vue
@@ -1,7 +1,6 @@
 <script setup>
 import { ref, watch, useTemplateRef } from 'vue';
 import { FEATURE_FLAGS } from 'dashboard/featureFlags';
-import { INSTALLATION_TYPES } from 'dashboard/constants/installationTypes';
 import { ROLES } from 'dashboard/constants/permissions';
 
 import SearchInput from './SearchInput.vue';
@@ -52,10 +51,6 @@ watch(
     >
       <Policy
         :permissions="ROLES"
-        :installation-types="[
-          INSTALLATION_TYPES.ENTERPRISE,
-          INSTALLATION_TYPES.CLOUD,
-        ]"
         :feature-flag="FEATURE_FLAGS.ADVANCED_SEARCH"
         class="w-full"
       >
diff --git a/frontend/app/javascript/dashboard/routes/dashboard/captain/captain.routes.js b/frontend/app/javascript/dashboard/routes/dashboard/captain/captain.routes.js
index 2dc89486..922928f7 100644
--- a/frontend/app/javascript/dashboard/routes/dashboard/captain/captain.routes.js
+++ b/frontend/app/javascript/dashboard/routes/dashboard/captain/captain.routes.js
@@ -1,5 +1,4 @@
 import { FEATURE_FLAGS } from 'dashboard/featureFlags';
-import { INSTALLATION_TYPES } from 'dashboard/constants/installationTypes';
 import { frontendURL } from '../../../helper/URLHelper';
 
 import CaptainPageRouteView from './pages/CaptainPageRouteView.vue';
@@ -21,19 +20,16 @@ import CustomToolsIndex from './tools/Index.vue';
 const meta = {
   permissions: ['administrator'],
   featureFlag: FEATURE_FLAGS.CAPTAIN,
-  installationTypes: [INSTALLATION_TYPES.CLOUD, INSTALLATION_TYPES.ENTERPRISE],
 };
 
 const metaCustomTools = {
   permissions: ['administrator'],
   featureFlag: FEATURE_FLAGS.CAPTAIN_CUSTOM_TOOLS,
-  installationTypes: [INSTALLATION_TYPES.CLOUD, INSTALLATION_TYPES.ENTERPRISE],
 };
 
 const metaV2 = {
   permissions: ['administrator'],
   featureFlag: FEATURE_FLAGS.CAPTAIN_V2,
-  installationTypes: [INSTALLATION_TYPES.CLOUD, INSTALLATION_TYPES.ENTERPRISE],
 };
 
 const assistantRoutes = [
@@ -114,10 +110,6 @@ const assistantRoutes = [
     name: 'captain_assistants_create_index',
     meta: {
       permissions: ['administrator'],
-      installationTypes: [
-        INSTALLATION_TYPES.CLOUD,
-        INSTALLATION_TYPES.ENTERPRISE,
-      ],
     },
   },
   {
diff --git a/frontend/app/javascript/dashboard/routes/dashboard/companies/routes.js b/frontend/app/javascript/dashboard/routes/dashboard/companies/routes.js
index 42ed6bd1..8b9ed6a8 100644
--- a/frontend/app/javascript/dashboard/routes/dashboard/companies/routes.js
+++ b/frontend/app/javascript/dashboard/routes/dashboard/companies/routes.js
@@ -2,12 +2,10 @@ import { frontendURL } from '../../../helper/URLHelper';
 import CompaniesIndex from './pages/CompaniesIndex.vue';
 import CompanyDetailView from './pages/CompanyDetailView.vue';
 import { FEATURE_FLAGS } from '../../../featureFlags';
-import { INSTALLATION_TYPES } from 'dashboard/constants/installationTypes';
 
 const commonMeta = {
   featureFlag: FEATURE_FLAGS.COMPANIES,
   permissions: ['administrator', 'agent'],
-  installationTypes: [INSTALLATION_TYPES.CLOUD, INSTALLATION_TYPES.ENTERPRISE],
 };
 
 export const routes = [
diff --git a/frontend/app/javascript/dashboard/routes/dashboard/settings/agents/AddAgent.vue b/frontend/app/javascript/dashboard/routes/dashboard/settings/agents/AddAgent.vue
index 96ada35d..57f347d3 100644
--- a/frontend/app/javascript/dashboard/routes/dashboard/settings/agents/AddAgent.vue
+++ b/frontend/app/javascript/dashboard/routes/dashboard/settings/agents/AddAgent.vue
@@ -75,9 +75,11 @@ const addAgent = async () => {
     };
 
     if (selectedRole.value.name.startsWith('custom_')) {
+      payload.role = 'agent';
       payload.custom_role_id = selectedRole.value.id;
     } else {
       payload.role = selectedRole.value.name;
+      payload.custom_role_id = null;
     }
 
     const agent = await store.dispatch('agents/create', payload);
diff --git a/frontend/app/javascript/dashboard/routes/dashboard/settings/agents/EditAgent.vue b/frontend/app/javascript/dashboard/routes/dashboard/settings/agents/EditAgent.vue
index 16913e9e..fbea996f 100644
--- a/frontend/app/javascript/dashboard/routes/dashboard/settings/agents/EditAgent.vue
+++ b/frontend/app/javascript/dashboard/routes/dashboard/settings/agents/EditAgent.vue
@@ -19,10 +19,6 @@ const props = defineProps({
     type: String,
     required: true,
   },
-  email: {
-    type: String,
-    default: '',
-  },
   type: {
     type: String,
     default: '',
@@ -126,7 +122,7 @@ const availabilityStatuses = computed(() =>
 
 const editAgent = async () => {
   v$.value.$touch();
-  if (v$.value.$invalid) return;
+  if (v$.value.$invalid || !selectedRole.value) return;
 
   try {
     const payload = {
@@ -137,6 +133,7 @@ const editAgent = async () => {
     };
 
     if (selectedRole.value.name.startsWith('custom_')) {
+      payload.role = 'agent';
       payload.custom_role_id = selectedRole.value.id;
     } else {
       payload.role = selectedRole.value.name;
@@ -248,7 +245,7 @@ const resetPassword = async () => {
           <Button
             type="submit"
             :label="$t('AGENT_MGMT.EDIT.FORM.SUBMIT')"
-            :disabled="v$.$invalid || uiFlags.isUpdating"
+            :disabled="v$.$invalid || uiFlags.isUpdating || !selectedRole"
             :is-loading="uiFlags.isUpdating"
           />
         </div>
diff --git a/frontend/app/javascript/dashboard/routes/dashboard/settings/agents/Index.vue b/frontend/app/javascript/dashboard/routes/dashboard/settings/agents/Index.vue
index 6e2f7df2..53f3ad4a 100644
--- a/frontend/app/javascript/dashboard/routes/dashboard/settings/agents/Index.vue
+++ b/frontend/app/javascript/dashboard/routes/dashboard/settings/agents/Index.vue
@@ -49,10 +49,20 @@ const filteredAgentList = computed(() => {
 const uiFlags = computed(() => getters['agents/getUIFlags'].value);
 const currentUserId = computed(() => getters.getCurrentUserID.value);
 const customRoles = useMapGetter('customRole/getCustomRoles');
+const customRoleLoadError = ref(false);
+
+const loadCustomRoles = async () => {
+  customRoleLoadError.value = false;
+  try {
+    await store.dispatch('customRole/getCustomRole');
+  } catch {
+    customRoleLoadError.value = true;
+  }
+};
 
 onMounted(() => {
   store.dispatch('agents/get');
-  store.dispatch('customRole/getCustomRole');
+  loadCustomRoles();
 });
 
 const findCustomRole = agent =>
@@ -99,9 +109,11 @@ const showDeleteAction = agent => {
   return true;
 };
 
-const showAlertMessage = message => {
-  loading.value[currentAgent.value.id] = false;
-  currentAgent.value = {};
+const showAlertMessage = (message, id) => {
+  loading.value[id] = false;
+  if (currentAgent.value.id === id) {
+    currentAgent.value = {};
+  }
   agentAPI.value.message = message;
   useAlert(message);
 };
@@ -132,15 +144,17 @@ const closeDeletePopup = () => {
 const deleteAgent = async id => {
   try {
     await store.dispatch('agents/delete', id);
-    showAlertMessage(t('AGENT_MGMT.DELETE.API.SUCCESS_MESSAGE'));
+    showAlertMessage(t('AGENT_MGMT.DELETE.API.SUCCESS_MESSAGE'), id);
   } catch (error) {
-    showAlertMessage(t('AGENT_MGMT.DELETE.API.ERROR_MESSAGE'));
+    showAlertMessage(t('AGENT_MGMT.DELETE.API.ERROR_MESSAGE'), id);
   }
 };
 const confirmDeletion = () => {
-  loading.value[currentAgent.value.id] = true;
+  const id = currentAgent.value.id;
+  if (!id) return;
+  loading.value[id] = true;
   closeDeletePopup();
-  deleteAgent(currentAgent.value.id);
+  deleteAgent(id);
 };
 </script>
 
@@ -175,6 +189,19 @@ const confirmDeletion = () => {
       </BaseSettingsHeader>
     </template>
     <template #body>
+      <div
+        v-if="customRoleLoadError"
+        class="flex items-center justify-between gap-3 border-b border-n-weak px-4 py-3 text-sm text-n-slate-11"
+      >
+        <span>{{ $t('CUSTOM_ROLE.LIST.ERROR') }}</span>
+        <Button
+          slate
+          faded
+          size="sm"
+          :label="$t('CUSTOM_ROLE.LIST.RETRY')"
+          @click="loadCustomRoles"
+        />
+      </div>
       <span
         v-if="!filteredAgentList.length && searchQuery"
         class="flex-1 flex items-center justify-center py-20 text-center text-body-main !text-base text-n-slate-11"
@@ -294,7 +321,6 @@ const confirmDeletion = () => {
         :name="currentAgent.name"
         :provider="currentAgent.provider"
         :type="currentAgent.role"
-        :email="currentAgent.email"
         :availability="currentAgent.availability_status"
         :custom-role-id="currentAgent.custom_role_id"
         :active="currentAgent.active"
diff --git a/frontend/app/javascript/dashboard/routes/dashboard/settings/auditlogs/audit.routes.js b/frontend/app/javascript/dashboard/routes/dashboard/settings/auditlogs/audit.routes.js
index 753222f1..545c94ee 100644
--- a/frontend/app/javascript/dashboard/routes/dashboard/settings/auditlogs/audit.routes.js
+++ b/frontend/app/javascript/dashboard/routes/dashboard/settings/auditlogs/audit.routes.js
@@ -1,5 +1,4 @@
 import { FEATURE_FLAGS } from '../../../../featureFlags';
-import { INSTALLATION_TYPES } from 'dashboard/constants/installationTypes';
 import { frontendURL } from '../../../../helper/URLHelper';
 
 import SettingsWrapper from '../SettingsWrapper.vue';
@@ -22,10 +21,6 @@ export default {
           name: 'auditlogs_list',
           meta: {
             featureFlag: FEATURE_FLAGS.AUDIT_LOGS,
-            installationTypes: [
-              INSTALLATION_TYPES.CLOUD,
-              INSTALLATION_TYPES.ENTERPRISE,
-            ],
             permissions: ['administrator'],
           },
           component: AuditLogsHome,
diff --git a/frontend/app/javascript/dashboard/routes/dashboard/settings/billing/billing.routes.js b/frontend/app/javascript/dashboard/routes/dashboard/settings/billing/billing.routes.js
index 8c03257c..cab093bd 100644
--- a/frontend/app/javascript/dashboard/routes/dashboard/settings/billing/billing.routes.js
+++ b/frontend/app/javascript/dashboard/routes/dashboard/settings/billing/billing.routes.js
@@ -1,5 +1,5 @@
 import { frontendURL } from '../../../../helper/URLHelper';
-import { INSTALLATION_TYPES } from 'dashboard/constants/installationTypes';
+import store from 'dashboard/store';
 import SettingsWrapper from '../SettingsWrapper.vue';
 import Index from './Index.vue';
 
@@ -9,7 +9,13 @@ export default {
       path: frontendURL('accounts/:accountId/settings/billing'),
       meta: {
         permissions: ['administrator'],
-        installationTypes: [INSTALLATION_TYPES.CLOUD],
+      },
+      beforeEnter: to => {
+        const isCloud = store.getters['globalConfig/isOnChatwootCloud'];
+        const isCustomBranded =
+          store.getters['globalConfig/isACustomBrandedInstance'];
+        if (isCloud && !isCustomBranded) return true;
+        return { name: 'home', params: { accountId: to.params.accountId } };
       },
       component: SettingsWrapper,
       props: {
@@ -23,7 +29,6 @@ export default {
           name: 'billing_settings_index',
           component: Index,
           meta: {
-            installationTypes: [INSTALLATION_TYPES.CLOUD],
             permissions: ['administrator'],
           },
         },
diff --git a/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/Index.vue b/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/Index.vue
index 3b8af78f..e5afe3a1 100644
--- a/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/Index.vue
+++ b/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/Index.vue
@@ -22,6 +22,7 @@ const loading = ref({});
 const showDeleteConfirmationPopup = ref(false);
 const activeResponse = ref({});
 const searchQuery = ref('');
+const fetchError = ref(false);
 
 const records = useMapGetter('customRole/getCustomRoles');
 
@@ -40,10 +41,6 @@ const deleteRejectText = computed(
   () => `${t('CUSTOM_ROLE.DELETE.CONFIRM.NO')} ${activeResponse.value.name}`
 );
 
-const deleteMessage = computed(() => {
-  return ` ${activeResponse.value.name} ? `;
-});
-
 const isFeatureEnabledOnAccount = useMapGetter(
   'accounts/isFeatureEnabledonAccount'
 );
@@ -58,10 +55,11 @@ const isBehindAPaywall = computed(() => {
 });
 
 const fetchCustomRoles = async () => {
+  fetchError.value = false;
   try {
     await store.dispatch('customRole/getCustomRole');
-  } catch (error) {
-    // Ignore Error
+  } catch {
+    fetchError.value = true;
   }
 };
 
@@ -78,9 +76,11 @@ const tableHeaders = computed(() => {
   ];
 });
 
-const showAlertMessage = message => {
-  loading.value[activeResponse.value.id] = false;
-  activeResponse.value = {};
+const showAlertMessage = (message, id) => {
+  loading.value[id] = false;
+  if (activeResponse.value.id === id) {
+    activeResponse.value = {};
+  }
   useAlert(message);
 };
 
@@ -114,18 +114,20 @@ const closeDeletePopup = () => {
 const deleteCustomRole = async id => {
   try {
     await store.dispatch('customRole/deleteCustomRole', id);
-    showAlertMessage(t('CUSTOM_ROLE.DELETE.API.SUCCESS_MESSAGE'));
+    showAlertMessage(t('CUSTOM_ROLE.DELETE.API.SUCCESS_MESSAGE'), id);
   } catch (error) {
     const errorMessage =
       error?.message || t('CUSTOM_ROLE.DELETE.API.ERROR_MESSAGE');
-    showAlertMessage(errorMessage);
+    showAlertMessage(errorMessage, id);
   }
 };
 
 const confirmDeletion = () => {
-  loading[activeResponse.value.id] = true;
+  const id = activeResponse.value.id;
+  if (!id) return;
+  loading.value[id] = true;
   closeDeletePopup();
-  deleteCustomRole(activeResponse.value.id);
+  deleteCustomRole(id);
 };
 </script>
 
@@ -133,7 +135,7 @@ const confirmDeletion = () => {
   <SettingsLayout
     :is-loading="uiFlags.fetchingList"
     :loading-message="$t('CUSTOM_ROLE.LOADING')"
-    :no-records-found="!records.length && !isBehindAPaywall"
+    :no-records-found="!records.length && !isBehindAPaywall && !fetchError"
     :no-records-message="$t('CUSTOM_ROLE.LIST.404')"
   >
     <template #header>
@@ -141,13 +143,11 @@ const confirmDeletion = () => {
         v-model:search-query="searchQuery"
         :title="$t('CUSTOM_ROLE.HEADER')"
         :description="$t('CUSTOM_ROLE.DESCRIPTION')"
-        :link-text="$t('CUSTOM_ROLE.LEARN_MORE')"
         :search-placeholder="$t('CUSTOM_ROLE.SEARCH_PLACEHOLDER')"
-        feature-name="canned_responses"
       >
-        <template v-if="records?.length" #count>
+        <template v-if="filteredRecords?.length" #count>
           <span class="text-body-main text-n-slate-11">
-            {{ $t('CUSTOM_ROLE.COUNT', { n: records.length }) }}
+            {{ $t('CUSTOM_ROLE.COUNT', { n: filteredRecords.length }) }}
           </span>
         </template>
         <template #actions>
@@ -162,7 +162,22 @@ const confirmDeletion = () => {
     </template>
 
     <template #body>
-      <CustomRolePaywall v-if="isBehindAPaywall" />
+      <div
+        v-if="fetchError && !isBehindAPaywall"
+        class="flex flex-col items-center justify-center gap-3 py-20"
+      >
+        <p class="text-base text-n-slate-12">
+          {{ $t('CUSTOM_ROLE.LIST.ERROR') }}
+        </p>
+        <Button
+          slate
+          faded
+          size="sm"
+          :label="$t('CUSTOM_ROLE.LIST.RETRY')"
+          @click="fetchCustomRoles"
+        />
+      </div>
+      <CustomRolePaywall v-else-if="isBehindAPaywall" />
       <BaseTable
         v-else
         :headers="tableHeaders"
@@ -201,7 +216,6 @@ const confirmDeletion = () => {
       :on-confirm="confirmDeletion"
       :title="$t('CUSTOM_ROLE.DELETE.CONFIRM.TITLE')"
       :message="$t('CUSTOM_ROLE.DELETE.CONFIRM.MESSAGE')"
-      :message-value="deleteMessage"
       :confirm-text="deleteConfirmText"
       :reject-text="deleteRejectText"
     />
diff --git a/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/component/CustomRoleModal.spec.js b/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/component/CustomRoleModal.spec.js
new file mode 100644
index 00000000..63a6ac63
--- /dev/null
+++ b/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/component/CustomRoleModal.spec.js
@@ -0,0 +1,57 @@
+import { shallowMount } from '@vue/test-utils';
+import CustomRoleModal from './CustomRoleModal.vue';
+
+vi.mock('dashboard/composables', () => ({ useAlert: vi.fn() }));
+const mockedStore = vi.hoisted(() => ({ dispatch: vi.fn() }));
+vi.mock('dashboard/composables/store', () => ({
+  useStore: () => mockedStore,
+}));
+
+const Button = {
+  props: ['label', 'disabled', 'isLoading'],
+  template: '<button :disabled="disabled">{{ label }}</button>',
+};
+
+const mountModal = selectedRole =>
+  shallowMount(CustomRoleModal, {
+    props: { mode: 'edit', selectedRole },
+    global: {
+      stubs: {
+        Button,
+        'woot-modal-header': true,
+      },
+    },
+  });
+
+describe('CustomRoleModal', () => {
+  it('preserves the existing conversation permissions while hydrating an edit form', async () => {
+    const selectedRole = {
+      name: 'Support',
+      description: 'Support role',
+      permissions: ['conversation_manage', 'contact_manage'],
+    };
+    const wrapper = mountModal(selectedRole);
+    await wrapper.vm.$nextTick();
+
+    expect(wrapper.find('#conversation_manage').element.checked).toBe(true);
+    expect(
+      wrapper.find('#conversation_unassigned_manage').element.checked
+    ).toBe(false);
+    expect(
+      wrapper.find('#conversation_participating_manage').element.checked
+    ).toBe(false);
+  });
+
+  it('does not mutate the role permissions when editing the form', async () => {
+    const selectedRole = {
+      name: 'Support',
+      description: 'Support role',
+      permissions: ['contact_manage'],
+    };
+    const wrapper = mountModal(selectedRole);
+
+    await wrapper.find('#report_manage').setValue(true);
+
+    expect(selectedRole.permissions).toEqual(['contact_manage']);
+  });
+});
diff --git a/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/component/CustomRoleModal.vue b/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/component/CustomRoleModal.vue
index ed67a063..888c6572 100644
--- a/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/component/CustomRoleModal.vue
+++ b/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/component/CustomRoleModal.vue
@@ -34,6 +34,7 @@ const { t } = useI18n();
 const name = ref('');
 const description = ref('');
 const selectedPermissions = ref([]);
+let isPopulatingEditForm = false;
 
 const nameInput = ref(null);
 
@@ -58,14 +59,18 @@ const resetForm = () => {
 };
 
 const populateEditForm = () => {
+  isPopulatingEditForm = true;
   name.value = props.selectedRole.name || '';
   description.value = props.selectedRole.description || '';
-  selectedPermissions.value = props.selectedRole.permissions || [];
+  selectedPermissions.value = [...(props.selectedRole.permissions || [])];
+  isPopulatingEditForm = false;
 };
 
 watch(
   selectedPermissions,
   (newValue, oldValue) => {
+    if (isPopulatingEditForm) return;
+
     // Check if manage all conversation permission is added or removed
     const hasAddedManageAllConversation =
       newValue.includes(MANAGE_ALL_CONVERSATION_PERMISSIONS) &&
@@ -92,7 +97,7 @@ watch(
       );
     }
   },
-  { deep: true }
+  { deep: true, flush: 'sync' }
 );
 
 onMounted(() => {
diff --git a/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/customRole.routes.js b/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/customRole.routes.js
index 33d7df6c..361231e2 100644
--- a/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/customRole.routes.js
+++ b/frontend/app/javascript/dashboard/routes/dashboard/settings/customRoles/customRole.routes.js
@@ -1,5 +1,4 @@
 import { FEATURE_FLAGS } from '../../../../featureFlags';
-import { INSTALLATION_TYPES } from 'dashboard/constants/installationTypes';
 import { frontendURL } from 'dashboard/helper/URLHelper';
 
 import SettingsWrapper from '../SettingsWrapper.vue';
@@ -20,10 +19,6 @@ export default {
           name: 'custom_roles_list',
           meta: {
             featureFlag: FEATURE_FLAGS.CUSTOM_ROLES,
-            installationTypes: [
-              INSTALLATION_TYPES.CLOUD,
-              INSTALLATION_TYPES.ENTERPRISE,
-            ],
             permissions: ['administrator'],
           },
           component: CustomRolesHome,
diff --git a/frontend/app/javascript/dashboard/routes/dashboard/settings/sla/sla.routes.js b/frontend/app/javascript/dashboard/routes/dashboard/settings/sla/sla.routes.js
index b44a8516..e69040de 100644
--- a/frontend/app/javascript/dashboard/routes/dashboard/settings/sla/sla.routes.js
+++ b/frontend/app/javascript/dashboard/routes/dashboard/settings/sla/sla.routes.js
@@ -1,5 +1,4 @@
 import { FEATURE_FLAGS } from '../../../../featureFlags';
-import { INSTALLATION_TYPES } from 'dashboard/constants/installationTypes';
 import { frontendURL } from '../../../../helper/URLHelper';
 
 import SettingsWrapper from '../SettingsWrapper.vue';
@@ -8,7 +7,6 @@ import Index from './Index.vue';
 const meta = {
   featureFlag: FEATURE_FLAGS.SLA,
   permissions: ['administrator'],
-  installationTypes: [INSTALLATION_TYPES.CLOUD, INSTALLATION_TYPES.ENTERPRISE],
 };
 
 export default {
diff --git a/frontend/app/javascript/dashboard/store/modules/customRole.js b/frontend/app/javascript/dashboard/store/modules/customRole.js
index 7f931f6f..236bda12 100644
--- a/frontend/app/javascript/dashboard/store/modules/customRole.js
+++ b/frontend/app/javascript/dashboard/store/modules/customRole.js
@@ -29,8 +29,10 @@ export const actions = {
       const response = await CustomRoleAPI.get();
       commit(types.default.SET_CUSTOM_ROLE, response.data);
       commit(types.default.SET_CUSTOM_ROLE_UI_FLAG, { fetchingList: false });
+      return response.data;
     } catch (error) {
       commit(types.default.SET_CUSTOM_ROLE_UI_FLAG, { fetchingList: false });
+      return throwErrorMessage(error);
     }
   },
 
@@ -68,10 +70,10 @@ export const actions = {
     try {
       await CustomRoleAPI.delete(id);
       commit(types.default.DELETE_CUSTOM_ROLE, id);
-      commit(types.default.SET_CUSTOM_ROLE_UI_FLAG, { deletingItem: true });
+      commit(types.default.SET_CUSTOM_ROLE_UI_FLAG, { deletingItem: false });
       return id;
     } catch (error) {
-      commit(types.default.SET_CUSTOM_ROLE_UI_FLAG, { deletingItem: true });
+      commit(types.default.SET_CUSTOM_ROLE_UI_FLAG, { deletingItem: false });
       return throwErrorMessage(error);
     }
   },
diff --git a/frontend/app/javascript/dashboard/store/modules/specs/customRole/actions.spec.js b/frontend/app/javascript/dashboard/store/modules/specs/customRole/actions.spec.js
index 27a08e27..5fae923e 100644
--- a/frontend/app/javascript/dashboard/store/modules/specs/customRole/actions.spec.js
+++ b/frontend/app/javascript/dashboard/store/modules/specs/customRole/actions.spec.js
@@ -20,7 +20,7 @@ describe('#actions', () => {
     });
     it('sends correct actions if API is error', async () => {
       axios.get.mockRejectedValue({ message: 'Incorrect header' });
-      await actions.getCustomRole({ commit });
+      await expect(actions.getCustomRole({ commit })).rejects.toThrow(Error);
       expect(commit.mock.calls).toEqual([
         [types.default.SET_CUSTOM_ROLE_UI_FLAG, { fetchingList: true }],
         [types.default.SET_CUSTOM_ROLE_UI_FLAG, { fetchingList: false }],
@@ -80,7 +80,7 @@ describe('#actions', () => {
       expect(commit.mock.calls).toEqual([
         [types.default.SET_CUSTOM_ROLE_UI_FLAG, { deletingItem: true }],
         [types.default.DELETE_CUSTOM_ROLE, 1],
-        [types.default.SET_CUSTOM_ROLE_UI_FLAG, { deletingItem: true }],
+        [types.default.SET_CUSTOM_ROLE_UI_FLAG, { deletingItem: false }],
       ]);
     });
     it('sends correct actions if API is error', async () => {
@@ -90,7 +90,7 @@ describe('#actions', () => {
       );
       expect(commit.mock.calls).toEqual([
         [types.default.SET_CUSTOM_ROLE_UI_FLAG, { deletingItem: true }],
-        [types.default.SET_CUSTOM_ROLE_UI_FLAG, { deletingItem: true }],
+        [types.default.SET_CUSTOM_ROLE_UI_FLAG, { deletingItem: false }],
       ]);
     });
   });
diff --git a/frontend/app/javascript/v3/helpers/specs/RouteHelper.spec.js b/frontend/app/javascript/v3/helpers/specs/RouteHelper.spec.js
index ffd4115f..040e3b55 100644
--- a/frontend/app/javascript/v3/helpers/specs/RouteHelper.spec.js
+++ b/frontend/app/javascript/v3/helpers/specs/RouteHelper.spec.js
@@ -57,9 +57,9 @@ describe('#validateRouteAccess', () => {
     expect(next).toHaveBeenCalledWith('/app/login');
   });
 
-  it('allows routes that were previously restricted to enterprise installs', () => {
+  it('ignores unknown route metadata', () => {
     validateRouteAccess(
-      { name: 'reset_password', meta: { requireEnterprise: true } },
+      { name: 'reset_password', meta: { legacyAccessFlag: true } },
       next
     );
     expect(next).toHaveBeenCalledWith();